Decay unmatched order-response buffer and exempt benign acks (fixes #218)

[wjllance]

Summary

0c076b1 started routing every order-response whose request_id did not match a pending place into unmatched_order_responses, freezing the maker (cancel all quotes + reconnect) once the buffer exceeded 256 entries. The buffer never decayed, and it had stable benign sources, so any long live session grew the count monotonically until it hit the cap and falsely failed closed:

1. The reduce-only inventory-exit market order (cycle.rs) used .await? and discarded its submission id, so its async ack was never registered as pending and always counted as unmatched.
2. Late acks for places already dropped by pending.retain(|p| cycle - p.cycle <= 2).
3. Cancel acks, which legitimately carry a request_id with no matching pending place.

Changes

• Decay (standx-maker/src/runtime.rs): unmatched entries are now stamped with the cycle they arrived and aged out after UNMATCHED_ORDER_RESPONSE_TTL_CYCLES (8). Bounded-rate benign responses can no longer grow the buffer without limit; only a sustained flood of genuinely-uncorrelated responses within the window still overflows and fails closed, preserving the real protection.
• Exempt the inventory-exit ack (standx-cli/src/commands/maker/cycle.rs): the exit submission id is registered into pending with a sentinel level (so it never reserves a real quote slot) so its async ack correlates as matched. A reduce-only market order never rests, so reconciliation drops it when pending ages out.
• Event OrderResponseUnmatched now carries the current cycle (standx-cli/src/commands/maker/runtime.rs).

Auth acks are consumed inside OrderResponseStream::connect() and never reach the channel, so they were already exempt.

Test plan

• cargo fmt -- --check — no diff
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test -p standx-maker and cargo test -p standx-cli — pass
• New regression test benign_unmatched_responses_decay_over_a_long_session drives 10,000 cycles of steady benign unmatched responses and asserts the buffer stays bounded and never freezes; the existing unmatched_response_overflow_fails_closed test confirms a same-cycle flood still fails closed.

Fixes #218

🤖 Generated with Claude Code