WobbleBot 2.0.12

WobbleBot 2.0.12 closes the silent fill-loss path found on 2026-09-18 (ADR-046): a fill Kraken had confirmed, whose trade rows the same tick's TradesHistory snapshot did not yet list, was committed as a closed order with zero trade rows and never re-examined. One of eight engine fills in the evidenced 09-09 to 09-18 window was lost this way; the daily reconcile reported it for eight days until a hand backfill.

• A confirmed fill whose trade rows do not cover its filled_amount is pending, never final. save_fill refuses the shape; the order is closed and a pending_fill_trades marker written in one transaction, so the counter-order still fires exactly once.
• The engine sweeps markers every tick using the order's own trade list (QueryOrders trades=true, then QueryTrades; verified read-only against the live account), records rows as they arrive, and clears the marker once the fill is covered. Bound: 120 lookups that ran and left the fill uncovered, or 30 minutes; a give-up keeps the marker, logs ERROR, pages "Fill recorded without its trade rows", and is re-raised at every later boot until backfilled.
• A restart resumes any sweep the previous process left; the cancel path and the boot reconciler use the same resolution. The ADR-038 fee-drift page now fires on a recovery tick as well as a fill tick.
• live.db gains one additive table, created on the first boot; no settings or key change. Upgrade and rollback notes: docs/release/v2.0.12-upgrade.md.

Review gate: five dimension reviewers, a sixth on the fix round, the completeness critic, and a read of that fix (16 + 12 findings, every code finding fixed and pinned); 22 of 22 mutants caught; 4,300 tests passed at the tip. Details in PR #152 and the roadmap receipt.

Deploy is the operator's two steps: this tag publishes the image; the IMAGE_TAG bump on the file-based stack applies it.