feat(exchange): keep Hyperliquid market orders within the bound around the mark

[MarcosACH]

Closes #467

A market order on Hyperliquid was priced from the last trade only. A stale trade can send an order far from the market. Say a short is held, the last trade is 100, and the mark has fallen to 96. A buy at 105 is about 9% above the market, not 5%.

Now the adapter caps every market order by the mark too, inside the same SLIPPAGE_BOUND (ADR-0059).

• A buy goes out at the lower of trade × (1 + bound) and mark × (1 + bound).
• A sell goes out at the higher of trade × (1 − bound) and mark × (1 − bound).
• With no mark cached, place raises and sends nothing. This is the same as with no trade today.
• Limit orders are unchanged. Paper is unchanged.

Docs: .env.example, the adapter docstring, the config comment, and the ADR-0030 and ADR-0059 notes now say the price is capped by the mark.

Live flatten is still refused, so it cannot send a close before the first mark arrives. #475 owns that, and a comment there says flatten must count a symbol as priced only once it has a trade and a mark.

Tests

Hyperliquid, faked at HTTP:

• A market buy with a trade far above the mark goes out at the mark-capped price.
• A market sell with a trade far below the mark gets the same cap on the other side.
• A market order with no mark raises and sends nothing.

pytest, ruff, mypy, and lint-imports are green.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[MarcosACH]

Review of ralph/issue-467 @ 5e8edbf

Reviewer: code-review skill
Reviewed: 2026-10-12
Optimization axis: correctness

Mechanical

• ruff format: pass
• ruff check: pass
• mypy: pass
• lint-imports: pass (7 kept, 0 broken)
• pytest: pass (2038 passed, 49 skipped, coverage gate ≥90% met)

Findings

[NIT] R001 — docs/adr/0030-instrument-universe-and-order-mapping.md:50 — Build status rewritten inside an existing amendment

Category: docs
Why: ADRs are append-corrected (docs/agents/adr-reading.md). This PR changes "Not built yet." inside the ADR-0059 amendment block, but in ADR-0059 it appends a new (Built in #467) block. The two ADRs now record the same fact in two different ways.
Fix: Restore "Not built yet." and append a short **(Built in [#467](...):** ...**)** block after it, as done in ADR-0059.
Status: open

Checked and clean

• All four acceptance criteria of #467 are met. Each one has a test faked at HTTP. Limit tests place with no trade and no mark, so "limit unchanged" is covered.
• The price rule matches ADR-0059: min for a buy, max for a sell, then passive quantization. Rounding can only make the price tighter.
• A missing mark raises before any send, the same path as a missing trade. Nothing reaches the wire (post.requests == []).
• The mark cache is in memory, like the trade cache. After a restart both refill from the feed, so recovery does not change.
• The HyperliquidFeed already publishes MarkTick from activeAssetCtx on the same bus. Replay publishes one too. So no wiring change is needed.
• Docs-sync: .env.example, the adapter docstring, the config comment, ADR-0059, and the module map all agree. CONTEXT.md already said it. Paper is untouched.
• Live flatten before the first mark is out of scope. #475 owns it.

Summary

• BLOCKING: 0 open
• WARN: 0 open
• NIT: 1 open
• Merge: READY

Ralph-State: ready

[MarcosACH]

R001 — Status: resolved — 3fe9a5c

ADR-0030 keeps its original amendment text. The build note is now a new (Built in #467) block after it, the same as ADR-0059.