XTester v.0.0.78

A supervised Launcher Terminal and fail-closed HyperLiquid Testnet execution path, while XTester remains a strategy-independent platform.

Launcher Terminal:

• Added a bot sidebar and a central execution workspace with a live candle chart, worker state, positions, open orders, risk diagnostics, and bounded status updates.
• Added confirmed Pause, Resume, Stop, Cancel Orders, and Close Position commands. Active strategy source, weights, models, and provider bindings are never edited in place; changes require a validated bundle and a controlled worker restart.
• Launcher IPC now enforces a 2 MiB strict-UTF-8 NDJSON frame limit in both directions, bounded ordinary and reserved critical queues, and write deadlines. Critical acknowledgements complete only after the pipe accepts them; malformed/oversized input or delivery failure fails closed. Candle snapshot/delta revisions, gap detection, and resynchronization keep a stalled cockpit from silently blocking execution.

Live execution safety:

• Real mutations are restricted to a supervisor-attached HyperLiquid Testnet FuturesUSDT worker. Mainnet, unsupported exchanges/markets, direct unsupervised real-order launch, Strategy Risk SDK Live, State Store Live, and unverified closed assemblies remain fail-closed.
• Startup, manual Resume, and feed recovery keep execution disarmed until required feeds are ready, learning-only catch-up is complete, and a fresh authoritative account/order/position reconciliation succeeds immediately before arm. A local account/exchange/network lease also blocks a second XTester worker across different markets.
• Market intent and full/partial closes use a venue-normalized reduce-aware Limit + IOC path with a bounded ±5% collar and exchange tick/significant-figure rules. Stop and take-profit trigger mapping is explicit, unsupported FOK/TP-limit requests fail before the adapter, and logical client IDs map deterministically to one HyperLiquid CLOID for place/get/cancel.
• HyperLiquid performs one HTTP attempt with an 8-second adapter timeout inside a hard 10-second host boundary. A late read is discarded and requires fresh reconciliation. After a mutation adapter is invoked, any transport fault, cancellation, or timeout is an unknown outcome: it is never retried, disarms and holds execution before quarantine fsync, retains its lease while work can still be running, and creates a durable per-account/market quarantine. A primary quarantine-store failure latches the process and persists a separate failure sentinel when storage permits; acknowledgement or a clean snapshot cannot bypass unavailable state.
• Risk reconciliation now accounts conservatively for unknown external non-reduce orders, validates reservations and prices fail-closed, reserves Market Buy exposure at the actual collar, and verifies authoritative position reduction after every close.
• Every announced DEX/CEX recovery attempt now ends with a matching completion or failure identity; a failed attempt remains paused and disarmed without orphaning recovery state, and a later successful retry can reconcile and resume. EasyTrading clients complete asynchronous shutdown before the account lease is released; a shutdown failure retains the lease until worker exit and returns a nonzero code.

Verification and documentation:

• Added focused coverage for feed ordering and paired recovery lifecycle, execution-gate races, account-wide leases, durable quarantine, fast-fault/timeout/cancellation semantics, async client shutdown, order normalization, close verification, terminal transport, IPC backpressure, supervisor commands, and worker wiring.
• Updated the bilingual Launcher, Strategy SDK, MCP, Copilot, platform specifications, agent rules, and go-live runbook to the same guarded Testnet contract.
• No real Testnet order was sent by automated verification. The explicit tiny order/cancel acceptance and an eight-hour supervised Testnet soak remain open operational gates; this release does not claim production Mainnet readiness.