Hummingbot PMMSimpleController (by hummingbot, Apache-2.0) faithful port: 2+2-level symmetric pure market making on WLDUSDT.BINANCE 1m, 1%/2% spreads around mid, per-level triple-barrier executors (SL 3%, limit TP 2%, 45-min time limit, 1.5%/0.3% trailing stop), 5-min refresh, 15-s cooldown, 20x

Faithful translation of hummingbot's controllers/market_making/pmm_simple.py (PMMSimpleController, commit 9af100d6822da7d2d0291a906c730ef172284ee2, author: hummingbot, Apache-2.0; credit goes to the original authors). The controller file only overrides get_executor_config(). Every trading rule comes from the defaults in MarketMakingControllerBase / MarketMakingControllerConfigBase and from the PositionExecutor triple barrier, and each one is named below so the developer can translate them line for line. The source makes no performance claims; our backtest with real fees decides. MARKET (source default): connector binance_perpetual, trading_pair WLD-USDT, mapped to WLDUSDT.BINANCE (USD-M perpetual, maker 0.02% / taker 0.05%) on 1-MINUTE bars. Binance has 1m history for WLD back to 2023-07. BINANCE is over-represented in the corpus. A faithful port still keeps it, because the source's default connector and pair are Binance perpetual WLD-USDT. WLD itself is rarely used in the corpus, and the mechanism is under-represented on several counts: it trades long and short, works on a short horizon, and makes markets by providing passive liquidity on both sides with a triple barrier on each order. LEVELS: buy_spreads [0.01, 0.02] and sell_spreads [0.01, 0.02] give four level ids: buy_0, buy_1, sell_0 and sell_1. The optimization plan accepts only scalars, so these lists are declared as the scalar parameters buy_spread_0=0.01, buy_spread_1=0.02, sell_spread_0=0.01 and sell_spread_1=0.02. buy_amounts_pct and sell_amounts_pct default to None, which means equal distribution: total_amount_quote is split 50% buy side / 50% sell side, then equally across each side's levels, so each level gets 25% (scalars level_amount_pct_buy_0 = buy_1 = sell_0 = sell_1 = 0.25). The reference price is the mid price with spread_multiplier = 1, because pmm_simple has no custom processed_data. Level price = reference_price * (1 - spread) for buys and reference_price * (1 + spread) for sells. Level amount (base) = level quote amount / level price. SIZING (platform adaptation): the source's total_amount_quote default is 100 USDT on a 20x account. On our $100k engine, total_amount_quote = total_notional_equity_fraction (1.0) x get_account_equity() at executor creation. Each level is therefore 25% of equity notional, and the maximum one-sided exposure is 50% of equity (two levels on one side). config.leverage = 20 is the source default and within the BINANCE 20x cap; it only sets margin. Round quantities with make_qty, guard price > 0, cap notional at the computed value, and skip any level whose notional is below the $5 minimum. EXECUTION SUBSTITUTIONS (from context.execution_capabilities): (1) hedge_mode is unsupported (the source's position_mode default is HEDGE), and per_executor_deadlines are unsupported. The equivalent used here: the strategy keeps an internal ledger of up to four VIRTUAL executors, one per level id. Each has its own entry price, filled quantity, creation timestamp and barriers. Every virtual entry and exit is sent as a real order on the single NETTING position. The venue's net position therefore always equals the sum of the open virtual executors, and account PnL and fees equal the sum of the executors' PnL and fees, since in hedge mode each fill would also have been a separate order paying the same fee. Only margin usage and position reporting differ from hedge mode. (2) Mid price: this design uses no quote ticks, so the reference price is the latest 1m bar close. (3) Hummingbot ticks about once per second; we evaluate on each 1m bar close. executor_refresh_time of 300 s is 5 bars, and cooldown_time of 15 s rounds up to 1 bar, so a closed level may re-quote at the next bar close. Limit entries and the limit take-profit rest in the simulated venue and fill intrabar when a bar trades through their price. The stop loss is an intrabar protective stop: a reduce-oriented stop_market order on the net position, matched inside the bar by the platform's simulated venue and mirrored live. Time-limit and trailing exits are market orders at the close of the bar that detects them.

Preserves the previous implementation's signal, instrument, sizing, spreads, barriers and frozen parameter plan. Addresses the first QA defect by retaining executor exposure through partial or rejected closes, tracking signed compensation debt through confirmed fills, retrying terminally failed orders on subsequent control cycles and preventing level reuse until every outstanding order settles. Addresses the second defect by reconciling missing or resized barriers each control cycle and initiating tracked shutdown after barrier rejection, denial, expiration or failed construction. Ownership is registered before order submission to handle synchronous callbacks. Existing platform adaptations remain: bar close substitutes for mid, minute controls approximate source tick timing, and real orders implement virtual hedge executors on a NETTING account. Net-position reporting and virtual-executor economics require separate assessment; the negative truncated sandbox does not establish a correctness verdict. No independent verification was run. The required outbox file could not be written because this workspace permits read-only filesystem access; this response contains the complete task-bound JSON.

Code↔hypothesis misalignment found by the semantic auditor — the code does NOT implement the hypothesis. Re-code the strategy to implement the hypothesis EXACTLY (instrument, timeframe, direction, the named edge/mechanic, sizing). Concrete issues: Orphaned exposure: the code comments say a fill that arrives for an executor that is already closed (a same-bar race between TP and SL) gets neutralised at market. But the sibling-cancel loop in on_order_filled, along with _close_executor and _place_barriers, calls self._omap.pop(other) right after self._cancel(other). In the NautilusTrader backtest the cancel command is queued and only processed after the current bar has been worked through the matching engine (open, high, low, close). So in a bar where the TP limit fills on the high and the stop triggers on the low, the stop still fills. When it does, on_order_filled finds tag None and returns early, so the neutralising market order is never sent. Because the stop is reduce_only=False, that fill opens an opposite position at 20x with no ledger entry and no barriers. The net position then stops equalling the sum of the virtual executors, which breaks the netting-ledger equivalence the hypothesis requires. The -100% return and 100% drawdown are consistent with these leaked positions building up. ## Library refinements (from the knowledge library; test them, do not assume them) The library's market-making material says bar data cannot settle intrabar fill order. It names inventory risk as the main threat to a symmetric quoter, especially quoting against a trend (单边成交/逆势挂单). It recommends inventory limits with price skew (价格倾斜), volatility-scaled quotes, a short-term trend gate that cancels the risky side, and modest size. The first fix is to make the ledger safe on bars, closing the orphan-fill leak behind the -100% run; the other refinements reduce the left-skewed loss profile (60% win rate, PF 0.53). 1. [exit] Bar-safe barrier resolution and per-bar ledger reconciliation: reduce_only=True on all stop_market orders; keep cancelled order ids flagged 'cancel_pending' until OrderCanceled or OrderFilled arrives so a late fill is neutralised at market; when one bar touches both TP and SL, book STOP_LOSS; at each bar close, correct any net-position vs ledger gap of >= 1 size increment at market; stop quoting for 60 bars after more than 3 corrections within 1440 bars (source: 基于逐笔成交的高频回测系统兼论K线回测的缺陷 p.1) 2. [filter] Short-term trend gate: cancel and skip the counter-trend side: if ret15 > +1.0% and close > EMA30: no sell levels, cancel their unfilled entries; if ret15 < -1.0% and close < EMA30: same for buy levels; in either state, close losing counter-trend executors at market (source: 浅谈数字货币做市策略（2）：盘口策略 p.1; 数字货币高频策略详细入门 p.1; 加止损可以控制风险……那么，古尔丹，代价是什么呢？ p.1) 3. [sizing] Inventory cap plus quote skew: max_inventory = 0.25 of equity (no new orders on the side that would add to it); ref = close * (1 - 0.01 * inv / 0.25) (source: 浅谈数字货币做市策略（2）：盘口策略 p.1; 行业大佬揭秘算法交易：发明者量化平台做市商策略 p.1) 4. [parameter] Volatility-scaled spreads and barriers: spread_0 = max(0.01, 2*ATR60/close), spread_1 = 2*spread_0, TP = spread_0, SL = 3*spread_0, trailing activation = 1.5*spread_0, frozen at executor creation (source: 行业大佬揭秘算法交易：发明者量化平台做市商策略 p.1; 浅谈数字货币做市策略（2）：盘口策略 p.1) 5. [sizing] Cut total quoted notional to 0.25x equity: total_notional_equity_fraction = 0.25 (source: 行业大佬揭秘算法交易：发明者量化平台做市商策略 p.1; 基于逐笔成交的高频回测系统兼论K线回测的缺陷 p.1)

Verification failed (Layer 4 — QA review) [class=code_defect]: - [edge_concern] The truncated sandbox averaged -0.21968% per closed net position, with substantial modeled impact. Assess full-history economics and virtual-executor accounting separately; these results do not determine correctness. - [critical] _close_executor removes the executor and cancels its protection before confirming the market close. Closing fills tagged 'c' are ignored, and rejected or denied closing orders cannot recover the removed executor. A failed or incomplete close therefore leaves untracked exposure while the level can create another executor. Failed compensating orders tagged 'n' likewise leave exposure without recovery. (line 257) — fix: Retain a closing executor until confirmed fills exhaust its remaining quantity. Track closing and compensating quantities, handle rejection and incomplete execution, and reconcile outstanding exposure before releasing the level. - [critical] Rejection, denial or expiration of a protective stop only clears ex['sl'] through _release. _control_executor never recreates missing barriers. Consequently, an executor whose stop submission fails can remain exposed until its time limit or trailing exit, without the required 3% protective stop. A failed take-profit is similarly never restored. (line 352) — fix: Reconcile required barriers on each control cycle and handle failed submissions explicitly. Restore missing protection or close the executor through a tracked shutdown procedure; do not continue treating an unprotected executor as healthy.