Instruments: each firm's list from the master, and a session-aware futures draw

- lib/instrument-specs.ts (pure, tested): the CME specs — point value,
  tick size, one-tick spread, Yahoo ticker — replacing POINT_VALUES; the
  draw's maths; the 12-hour hold cap; the micro for drain and extra-day
  legs; reading a firm's list (the master's, or the old rules against an
  older master: this machine's enabled set less bans, the symbol map).
- lib/instruments.ts: the one module the trading paths ask. Measures every
  future's daily move from Yahoo's hourly candles once per trade date, and
  shows entry cost (a tick of spread plus Tradovate's fee parameters or
  TopstepX's last measured fill) without ever choosing by it.
- Futures Auto draws one root per batch from the batch firm's list: movement
  per dollar of spread early in the session with a 10% floor each, sliding
  to the fastest movers by the last entry; nothing expected to hold 12h or
  more; micros only if nothing else is listed. Every draw logs its odds.
- The batch is chosen before its instrument, and a group that can't trade
  anything yields to the next. Copy trade matches the held contract against
  the listed roots and won't copy an instrument it can't identify. Manual
  legs, manual orders and drain/extra-day legs follow the lists.
- DXtrade firms rank their own list whatever root was drawn.
- Capabilities, the dashboard's trade bar and contract resolves follow the
  lists; the trade bar and scheduler default to Auto. The master link
  reconnects when master_dashboard_url changes, and the catalog drops
  ?since after a switch so two masters' versions can't collide.
- Reports carry each futures firm's instrumentStats for the master's Firms
  page; GET /api/instruments shows them (?simulate=N runs the draw, no
  orders); the Settings page shows the lists read-only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/master-link.ts

@@ -15,10 +15,11 @@
  * master you control, and prefer https so it cannot be redirected in transit.
  */
 
-import { getSetting, setSetting, getInstruments, getRunnerHeartbeat, RUNNER_TIMEOUT_MS } from './db';
+import { getSetting, setSetting, getRunnerHeartbeat, RUNNER_TIMEOUT_MS } from './db';
 import { runTrade, startScheduler, stopScheduler, getSchedulerStatus } from './auto-trade';
 import { FIRMS, automationKey } from './automations';
-import { POINT_VALUES } from './trading-logic';
+import { CME_ROOTS, CME_SPECS } from './instrument-specs';
+import { futuresRootsHere } from './instruments';
 import { queueRun } from './queue-run';
 import { pushBackup } from './backup-sync';
 import { getBuildVersion } from './version';
@@ -35,6 +36,8 @@ const RECONNECT_MAX_MS = 60_000;
 
 interface LinkState {
     socket: WebSocket | null;
+    /** The master_dashboard_url the socket was opened for. */
+    url: string | null;
     /** Only true once the master has answered the hello. */
     ready: boolean;
     attempt: number;
@@ -47,7 +50,7 @@ const _g = globalThis as typeof globalThis & { __masterLink?: LinkState };
 
 function state(): LinkState {
     if (!_g.__masterLink) {
-        _g.__masterLink = { socket: null, ready: false, attempt: 0, reconnectTimer: null, stopped: false };
+        _g.__masterLink = { socket: null, url: null, ready: false, attempt: 0, reconnectTimer: null, stopped: false };
     }
     return _g.__masterLink;
 }
@@ -56,16 +59,16 @@ function state(): LinkState {
 
 /** What this instance can be asked to do, as of right now. */
 export function collectCapabilities(): InstanceCapabilities {
-    // Only symbols the operator has enabled here. An empty instruments table
-    // means nothing has been configured yet, so offer everything we can price.
-    const enabled = getInstruments().filter((i) => i.enabled).map((i) => i.symbol);
+    // The roots this machine's futures firms list (the master's per-firm
+    // instrument lists); none listed yet means offer everything we can price.
+    const listed = futuresRootsHere();
 
     // Same test the AutoBuyer page uses: `at` is epoch ms from the last ping.
     const heartbeat = getRunnerHeartbeat();
     const runnerOnline = heartbeat !== null && Date.now() - heartbeat.at < RUNNER_TIMEOUT_MS;
 
     return {
-        symbols: enabled.length > 0 ? enabled : Object.keys(POINT_VALUES),
+        symbols: listed.length > 0 ? listed : [...CME_ROOTS],
         automations: FIRMS.flatMap((firm) =>
             firm.automations
                 .filter((a) => a.steps.length > 0)
@@ -96,7 +99,7 @@ export function collectCapabilities(): InstanceCapabilities {
 async function execute(command: Command): Promise<unknown> {
     switch (command.kind) {
         case 'trade': {
-            if (command.symbol !== 'Auto' && !POINT_VALUES[command.symbol]) {
+            if (command.symbol !== 'Auto' && !CME_SPECS[command.symbol]) {
                 throw new Error(`Unknown symbol: ${command.symbol}`);
             }
             // Same order as POST /api/trade: (re)start the scheduler first,
@@ -163,8 +166,19 @@ function send(message: InstanceMessage): boolean {
     }
 }
 
+/** A changed master_dashboard_url drops the socket, and the reconnect dials
+ *  the new master — otherwise reports and commands would stay with the old
+ *  one until a restart, while the catalog followed the setting. */
+function followMasterUrl(): void {
+    const s = state();
+    if (!s.socket || s.url === getSetting('master_dashboard_url')) return;
+    console.log('[master-link] master_dashboard_url changed — reconnecting');
+    try { s.socket.close(1000, 'master changed'); } catch { /* the close handler reconnects */ }
+}
+
 /** True when the report went up the socket, so the caller can skip the POST. */
 export function pushReport(firms: unknown[], scheduler: unknown): boolean {
+    followMasterUrl();
     return send({
         type: 'report',
         firms: firms as never,
@@ -224,6 +238,7 @@ function connect() {
         return;
     }
     s.socket = socket;
+    s.url = masterUrl;
     s.ready = false;
 
     socket.addEventListener('open', () => {