@reefclaw/connect 0.1.20 → 0.1.21

package/assets/bridge/gateway/gateway-config.d.ts

@@ -1,3 +1,4 @@
+import { type VenueId } from '@reefclaw/shared';
 export interface GatewayConfig {
     /** Full gateway URL, e.g. "http://localhost:18789" */
     gatewayUrl: string;
@@ -5,10 +6,16 @@ export interface GatewayConfig {
     gatewayToken: string;
     /** Trading symbol, e.g. "BTC/USDT" */
     symbol: string;
-    /** Intelligence service URL (optional — regime classification) */
+    /** Intelligence service URL (regime classification + trade-result reporting) */
     intelligenceUrl?: string;
     /** Connection token for intelligence service auth */
     connectionToken?: string;
+    /** Trading venue this box is configured for. Decides how a canonical symbol
+     *  is spelled in the intel DB ('BTC/USDT' → 'BTCUSDT' vs 'BTC/USDC' →
+     *  'HL_BTC'), so every skill↔intel symbol crossing depends on it.
+     *  Optional so a hand-built config (tests, embedders) stays valid; every
+     *  consumer treats absent as 'binance', the historical behaviour. */
+    venue?: VenueId;
 }
 /** CLI args specific to gateway provider */
 export interface GatewayCliArgs {
@@ -20,17 +27,21 @@ export interface GatewayCliArgs {
 /**
  * Resolve gateway connection config with priority:
  * 1. CLI args (--gateway-url, --gateway-token, --symbol)
- * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL)
- * 3. OpenClaw config file (~/.openclaw/openclaw.json)
- * 4. Defaults (localhost:18789, BTC/USDT)
+ * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
+ * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
+ * matters.
  */
 export declare function resolveGatewayConfig(args: GatewayCliArgs): {
     gatewayUrl: string;
     gatewayToken: string | null;
     symbol: string;
-    intelligenceUrl: string | null;
+    intelligenceUrl: string;
+    venue: VenueId;
 };
 /**
  * Validate that the resolved config has all required fields.

package/assets/bridge/gateway/gateway-config.js

@@ -5,11 +5,27 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import JSON5 from 'json5';
+import { parseVenue, VENUE_DEFAULT_SYMBOL } from '@reefclaw/shared';
 import { logger } from '../logger.js';
 const TAG = 'gateway-config';
 const DEFAULT_GATEWAY_PORT = 18789;
 const DEFAULT_GATEWAY_HOST = 'localhost';
-const DEFAULT_SYMBOL = 'BTC/USDT';
+/**
+ * Same default the plugin hardcodes (plugin/src/index.ts) so the two processes
+ * agree on the intel service without any operator configuration.
+ *
+ * ★ Before 2026-07-27 the skill had NO default and NO config-file fallback:
+ * `intelligenceUrl` came only from `--intelligence-url` or
+ * `REEFCLAW_INTELLIGENCE_URL`, and NOTHING in the repo ever set either one —
+ * not the installer, not a systemd unit, not a deploy script. The skill is the
+ * ONLY writer of intel's `trade_results` table, so on every default install
+ * every closed trade was dropped at debug level inside `reportTradeResult`.
+ * Downstream that meant `tradeCount` never reached `minTradesForKelly`, Kelly
+ * sizing was pinned at `cappedReason: 'insufficient_history'` forever, and
+ * `get_agent_profile` reported tier `novice` / 0 trades no matter how much the
+ * agent traded. Reads had a default; the write did not.
+ */
+const DEFAULT_INTELLIGENCE_URL = 'https://intel.reefclaw.com';
 // ---- Read OpenClaw config file ----
 function getConfigPath() {
     return process.env.OPENCLAW_CONFIG_PATH
@@ -28,18 +44,48 @@ function readOpenClawJson() {
         return null;
     }
 }
+// ---- Read the plugin's own config file ----
+function getPluginConfigPath() {
+    return process.env.REEFCLAW_PLUGIN_CONFIG_PATH
+        || join(homedir(), '.reefclaw', 'plugin-config.json');
+}
+/**
+ * Best-effort read of ~/.reefclaw/plugin-config.json — the file that already
+ * carries `intelligenceUrl` and `exchange.venue` for the plugin. Reading the
+ * same file here makes the two processes agree by construction rather than by
+ * convention (the skill previously had no way at all to learn either value).
+ * Fail-soft: null on a missing/unreadable/malformed file, which is the common
+ * case on a chat-install box that never writes this file.
+ */
+function readPluginConfig() {
+    const path = getPluginConfigPath();
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        logger.debug(TAG, `Could not read plugin config from ${path}`);
+        return null;
+    }
+}
 // ---- Resolve gateway config ----
 /**
  * Resolve gateway connection config with priority:
  * 1. CLI args (--gateway-url, --gateway-token, --symbol)
- * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL)
- * 3. OpenClaw config file (~/.openclaw/openclaw.json)
- * 4. Defaults (localhost:18789, BTC/USDT)
+ * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
+ * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
+ * matters.
  */
 export function resolveGatewayConfig(args) {
     const ocConfig = readOpenClawJson();
+    const pluginConfig = readPluginConfig();
     // --- Gateway URL ---
     // CLI > env > construct from openclaw.json port > default
     const port = ocConfig?.gateway?.port ?? DEFAULT_GATEWAY_PORT;
@@ -56,24 +102,34 @@ export function resolveGatewayConfig(args) {
     if (fileToken && !args.gatewayToken && !process.env.OPENCLAW_GATEWAY_TOKEN) {
         logger.info(TAG, 'Using gateway token from OpenClaw config');
     }
+    // --- Venue ---
+    // env > plugin-config.json exchange.venue > binance. Resolved BEFORE the
+    // symbol because it decides both the symbol default and the intel spelling.
+    // parseVenue surfaces a mis-spelled value instead of silently coercing it.
+    const { venue, unrecognized } = parseVenue(process.env.REEFCLAW_VENUE ?? pluginConfig?.exchange?.venue);
+    if (unrecognized) {
+        logger.warn(TAG, `Unrecognized venue '${unrecognized}' — falling back to binance`);
+    }
     // --- Symbol ---
-    // CLI > env > default
+    // CLI > env > the VENUE's default. A venue-blind 'BTC/USDT' default on a
+    // hyperliquid box is a symbol that venue rejects everywhere it's consumed
+    // (the issue-#174 class of bug).
     const symbol = args.symbol
         || process.env.REEFCLAW_SYMBOL
-        || DEFAULT_SYMBOL;
+        || VENUE_DEFAULT_SYMBOL[venue];
     if (!gatewayToken) {
         logger.warn(TAG, 'Gateway token not found in CLI args, env vars, or OpenClaw config');
     }
     // --- Intelligence URL ---
-    // CLI > env > default
+    // CLI > env > plugin-config.json > default. A default is mandatory: this URL
+    // gates the ONLY writer of intel's trade_results (see the constant).
     const intelligenceUrl = args.intelligenceUrl
         || process.env.REEFCLAW_INTELLIGENCE_URL
-        || null;
-    if (intelligenceUrl) {
-        logger.info(TAG, `Intelligence service: ${intelligenceUrl}`);
-    }
+        || pluginConfig?.intelligenceUrl
+        || DEFAULT_INTELLIGENCE_URL;
+    logger.info(TAG, `Intelligence service: ${intelligenceUrl} (venue=${venue})`);
     logger.debug(TAG, `Resolved: url=${gatewayUrl}, token=${gatewayToken ? '***' : '(none)'}, symbol=${symbol}`);
-    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl };
+    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl, venue };
 }
 /**
  * Validate that the resolved config has all required fields.

package/assets/bridge/gateway/poller.js

@@ -356,8 +356,14 @@ export class Poller {
         const tool = this.toolMap.fetch_positions;
         // Fetch ALL positions (no symbol filter) so multi-symbol trades are visible
         const result = await this.http.invoke(tool, {});
-        const positions = Array.isArray(result.data) ? result.data : [];
-        this.callbacks.onPositions(positions);
+        if (!Array.isArray(result.data)) {
+            // null ≠ empty: this cache is the emergency-Flatten fallback. Collapsing
+            // a garbage response to [] would let a later failed fresh read report
+            // "No positions to close" off poisoned data (audit 2026-07-26 F6).
+            logger.warn(TAG, `fetch_positions returned non-array (${typeof result.data}) — keeping last known positions`);
+            return;
+        }
+        this.callbacks.onPositions(result.data);
     }
     async pollBalance() {
         const tool = this.toolMap.fetch_balance;
@@ -370,13 +376,17 @@ export class Poller {
         // Fetch ALL open orders (no symbol filter) — this cache is the fallback
         // for the portfolio-wide Kill + reconcile snapshot (see interval comment).
         const result = await this.http.invoke(tool, {});
+        if (!Array.isArray(result.data)) {
+            // null ≠ empty: same reasoning as pollPositions — a garbage response
+            // must not overwrite the Kill fallback cache with a confirmed-empty [].
+            logger.warn(TAG, `fetch_open_orders returned non-array (${typeof result.data}) — keeping last known orders`);
+            return;
+        }
         const orders = [];
-        if (Array.isArray(result.data)) {
-            for (const ccxt of result.data) {
-                const mapped = mapCcxtOrder(ccxt);
-                if (mapped)
-                    orders.push(mapped);
-            }
+        for (const ccxt of result.data) {
+            const mapped = mapCcxtOrder(ccxt);
+            if (mapped)
+                orders.push(mapped);
         }
         this.callbacks.onOpenOrders(orders);
     }

package/assets/bridge/providers/emergency-commands.d.ts

@@ -29,8 +29,16 @@ export interface EmergencyContext {
  *
  * Caller must set agentMode = 'STOPPED' after this returns, and should pass a
  * FRESH all-symbols order snapshot (see the gateway wrapper).
+ *
+ * ★ null ≠ empty (audit 2026-07-26 F6): `freshOrders === null` means the fresh
+ * fetch FAILED — order state is unknown. A stale (≤60s) cache that happens to
+ * be empty is NOT proof of zero working orders, and reporting executed:true
+ * from it is exactly the false-green the 2026-06-19 fix exists to prevent. On
+ * a failed fresh read Kill still halts the agent and best-effort cancels the
+ * cached-known working set, but ALWAYS reports executed:false with the
+ * unverified-coverage reason.
  */
-export declare function executeKill(ctx: EmergencyContext, openOrders: OrderData[]): Promise<EmergencyResult>;
+export declare function executeKill(ctx: EmergencyContext, freshOrders: OrderData[] | null, cachedOrders?: OrderData[]): Promise<EmergencyResult>;
 /**
  * Flatten: close all open positions at market.
  * Caller must set agentMode = 'STOPPED' after this returns.

package/assets/bridge/providers/emergency-commands.js

@@ -30,11 +30,21 @@ function rejectionReasons(results, max = 3) {
  *
  * Caller must set agentMode = 'STOPPED' after this returns, and should pass a
  * FRESH all-symbols order snapshot (see the gateway wrapper).
+ *
+ * ★ null ≠ empty (audit 2026-07-26 F6): `freshOrders === null` means the fresh
+ * fetch FAILED — order state is unknown. A stale (≤60s) cache that happens to
+ * be empty is NOT proof of zero working orders, and reporting executed:true
+ * from it is exactly the false-green the 2026-06-19 fix exists to prevent. On
+ * a failed fresh read Kill still halts the agent and best-effort cancels the
+ * cached-known working set, but ALWAYS reports executed:false with the
+ * unverified-coverage reason.
  */
-export async function executeKill(ctx, openOrders) {
+export async function executeKill(ctx, freshOrders, cachedOrders = []) {
     if (!ctx.http) {
         return { action: 'kill', executed: false, timestamp: new Date().toISOString(), details: 'HTTP client not initialized' };
     }
+    const fresh = freshOrders !== null;
+    const openOrders = freshOrders ?? cachedOrders;
     // Protective = a stop/TP bracket (reduceOnly OR closePosition OR stop-type;
     // see mapCcxtOrder/isProtectiveOrder). Working = everything else (entries /
     // adds). Preserve protective so an open position is never left naked.
@@ -95,6 +105,15 @@ export async function executeKill(ctx, openOrders) {
             logger.warn(TAG, details);
         }
     }
+    if (!fresh) {
+        // Coverage is unverifiable: whatever the cached list said, orders placed
+        // in the last ≤60s are invisible to it. Never render a green "Killed".
+        executed = false;
+        details = working.length === 0
+            ? `Agent halted, but order state is UNVERIFIED — fresh order fetch failed and the cached snapshot shows no working orders; verify on the exchange${preservedNote}`
+            : `${details} — STALE snapshot (fresh order fetch failed); full coverage unverified`;
+        logger.error(TAG, details);
+    }
     return { action: 'kill', executed, timestamp: new Date().toISOString(), details };
 }
 /**
@@ -110,13 +129,19 @@ export async function executeFlatten(ctx, cachedPositions) {
     // ctx.symbol here narrowed the result to a single symbol, so positions on
     // every other symbol were silently skipped and never closed. The cached
     // fallback (this.positions) is already all-symbols.
+    // ★ null ≠ empty (audit 2026-07-26 F6): `fresh` records whether the list is
+    // exchange-confirmed. A stale cache that happens to be empty must NEVER
+    // produce a green "Flattened" — a position opened in the last ≤60s would be
+    // invisible to it and left running behind a STOPPED agent.
     let positions = cachedPositions;
+    let fresh = false;
     const fetchTool = ctx.toolMap.fetch_positions;
     if (fetchTool) {
         try {
             const result = await ctx.http.invokeEmergency(fetchTool, {});
             if (Array.isArray(result.data)) {
                 positions = result.data;
+                fresh = true;
             }
             else {
                 // Mirror gateway.ts fetchFreshPositions: a non-array response must
@@ -132,6 +157,11 @@ export async function executeFlatten(ctx, cachedPositions) {
     // Filter to non-zero positions
     const openPositions = positions.filter((p) => (p.contracts ?? 0) !== 0);
     if (openPositions.length === 0) {
+        if (!fresh) {
+            const details = 'Position state UNVERIFIED — fresh position fetch failed and the cached snapshot shows none; nothing was closed, verify on the exchange';
+            logger.error(TAG, details);
+            return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
+        }
         return { action: 'flatten', executed: true, timestamp: new Date().toISOString(), details: 'No positions to close' };
     }
     // Close each position
@@ -179,6 +209,13 @@ export async function executeFlatten(ctx, cachedPositions) {
         logger.error(TAG, details);
         return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
     }
+    if (!fresh) {
+        // Every cached-known position closed, but positions opened in the last
+        // ≤60s are invisible to a stale snapshot — coverage is unverifiable.
+        const details = `Closed ${succeeded}/${openPositions.length} positions from a STALE snapshot (fresh position fetch failed) — full coverage unverified, verify on the exchange`;
+        logger.error(TAG, details);
+        return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
+    }
     const details = `Closed ${succeeded}/${openPositions.length} positions`;
     return { action: 'flatten', executed: true, timestamp: new Date().toISOString(), details };
 }

package/assets/bridge/providers/gateway.d.ts

@@ -243,6 +243,20 @@ export declare class GatewayProvider implements OpenClawProvider {
      *  the WS store; under weight pressure isStoreTrusted() flickers between
      *  the two, so the raw symbol alternates poll-to-poll. */
     private canonicalSymbol;
+    /** Canonical symbol → the intel DB symbol for this box's venue.
+     *  binance: 'BTC/USDT' → 'BTCUSDT'; hyperliquid: 'BTC/USDC' → 'HL_BTC'.
+     *
+     *  ★ The old venue-blind `.replace('/','')` produced 'BTCUSDC' on a
+     *  hyperliquid box — a symbol no intel row has ever carried (intel
+     *  namespaces every HL row under the 'HL_' prefix). That silently broke the
+     *  regime/signal/mission/analytics pollers AND wrote every trade result to a
+     *  symbol Kelly sizing would never read back, so a hyperliquid box stayed at
+     *  `insufficient_history` even once the reporting path itself worked.
+     *
+     *  FAILS OPEN: an unmappable symbol falls back to the legacy concatenation
+     *  so intel answers "no data for <echo>" — honest and debuggable — rather
+     *  than the caller throwing and dropping the report entirely. */
+    private toIntelSymbol;
     private onPollerPositions;
     /**
      * Compare previous and current positions from polling.
@@ -279,6 +293,14 @@ export declare class GatewayProvider implements OpenClawProvider {
     private lastMarketStructure;
     private fetchFreshPositions;
     private fetchFreshBalance;
+    /** Strict fresh read — null on ANY failure (missing tool, thrown fetch,
+     *  non-array garbage). Callers whose verdict claims order-state coverage
+     *  (Kill) MUST distinguish "confirmed list" from "unknown"; collapsing a
+     *  failed read into the ≤60s cache here was how a stale-empty cache became
+     *  a green "No open orders to cancel" (audit 2026-07-26 F6). */
+    private fetchFreshOpenOrdersOrNull;
+    /** Cached-fallback wrapper for DISPLAY surfaces (the reconcile snapshot):
+     *  stale data beats a blank panel there. Never use for emergency verdicts. */
     private fetchFreshOpenOrders;
     private fetchAgentHealth;
     /**
@@ -387,7 +409,7 @@ export declare class GatewayProvider implements OpenClawProvider {
      * truthful-unknown beats confidently-wrong.
      */
     private seedLastTradeTs;
-    /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */
+    /** The configured symbol as the intel DB spells it. */
     private get intelligenceSymbol();
     /** Shared intelligence poller with circuit-breaker (exponential backoff on errors). */
     private startIntelligencePoller;

package/assets/bridge/providers/gateway.js

@@ -6,6 +6,7 @@ import { join } from 'path';
 import { homedir } from 'os';
 import { logger, formatError } from '../logger.js';
 import { isTradingMode } from '../types.js';
+import { toIntelSymbol } from '@reefclaw/shared';
 import { GatewayHttpClient } from '../gateway/gateway-http-client.js';
 import { GatewayWsClient } from '../gateway/gateway-ws-client.js';
 import { discoverTools } from '../gateway/tool-discovery.js';
@@ -572,10 +573,11 @@ export class GatewayProvider {
         const ctx = { http: this.http, toolMap: this.toolMap, symbol: this.config.symbol };
         // Pass a FRESH, all-symbols order snapshot so Kill cancels every working
         // order portfolio-wide and correctly identifies (and preserves) protective
-        // reduceOnly brackets. fetchFreshOpenOrders falls back to this.openOrders on
-        // any fetch error, so this never blocks the kill.
-        const freshOrders = await this.fetchFreshOpenOrders();
-        const result = await _executeKill(ctx, freshOrders);
+        // reduceOnly brackets. On a failed fresh read Kill still runs against the
+        // ≤60s cache (never blocked) but reports executed:false — a stale cache
+        // cannot verify coverage (audit 2026-07-26 F6).
+        const freshOrders = await this.fetchFreshOpenOrdersOrNull();
+        const result = await _executeKill(ctx, freshOrders, this.openOrders);
         this.agentMode = 'STOPPED';
         this.emitAgentState();
         return result;
@@ -660,16 +662,23 @@ export class GatewayProvider {
     // Thin wrappers — real logic lives in providers/onboarding-commands.ts
     // so unit tests can drive pure functions with a mocked HTTP client.
     async setTradingMode(mode, acknowledged) {
-        return executeSetTradingMode({ http: this.http, toolMap: this.toolMap }, mode, acknowledged);
+        return executeSetTradingMode(
+        // operatorToken = the rc_* connection token — the plugin refuses the
+        // four state-mutating operator tools without it (audit F12).
+        { http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, mode, acknowledged);
     }
     async setExchangeCredentials(apiKey, secret, testnet) {
-        return executeSetExchangeCredentials({ http: this.http, toolMap: this.toolMap }, apiKey, secret, testnet);
+        return executeSetExchangeCredentials({ http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, apiKey, secret, testnet);
     }
     async testExchangeCredentials(apiKey, secret, testnet) {
         return executeTestExchangeCredentials({ http: this.http, toolMap: this.toolMap }, apiKey, secret, testnet);
     }
     async clearExchangeCredentials() {
-        return executeClearExchangeCredentials({ http: this.http, toolMap: this.toolMap });
+        return executeClearExchangeCredentials({
+            http: this.http,
+            toolMap: this.toolMap,
+            operatorToken: this.config.connectionToken,
+        });
     }
     /** Operator-only. Read the current bracket-orders config from the plugin. */
     async getBracketConfig() {
@@ -677,7 +686,7 @@ export class GatewayProvider {
     }
     /** Operator-only. Flip requireStopLoss or requireTakeProfit. */
     async setBracketRequirement(flag, value) {
-        return executeSetBracketRequirement({ http: this.http, toolMap: this.toolMap }, flag, value);
+        return executeSetBracketRequirement({ http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, flag, value);
     }
     async getSnapshot() {
         logger.info(TAG, 'Reconciliation snapshot requested');
@@ -1195,6 +1204,28 @@ export class GatewayProvider {
     canonicalSymbol(s) {
         return typeof s === 'string' ? s.replace(/:[A-Z]+$/, '') : s;
     }
+    /** Canonical symbol → the intel DB symbol for this box's venue.
+     *  binance: 'BTC/USDT' → 'BTCUSDT'; hyperliquid: 'BTC/USDC' → 'HL_BTC'.
+     *
+     *  ★ The old venue-blind `.replace('/','')` produced 'BTCUSDC' on a
+     *  hyperliquid box — a symbol no intel row has ever carried (intel
+     *  namespaces every HL row under the 'HL_' prefix). That silently broke the
+     *  regime/signal/mission/analytics pollers AND wrote every trade result to a
+     *  symbol Kelly sizing would never read back, so a hyperliquid box stayed at
+     *  `insufficient_history` even once the reporting path itself worked.
+     *
+     *  FAILS OPEN: an unmappable symbol falls back to the legacy concatenation
+     *  so intel answers "no data for <echo>" — honest and debuggable — rather
+     *  than the caller throwing and dropping the report entirely. */
+    toIntelSymbol(symbol) {
+        const canonical = this.canonicalSymbol(symbol);
+        try {
+            return toIntelSymbol(this.config.venue ?? 'binance', canonical);
+        }
+        catch {
+            return canonical.replace('/', '');
+        }
+    }
     async onPollerPositions(positions) {
         // Canonicalize symbols at this single position-ingress chokepoint so
         // the ENTIRE skill (position-diff, openTradeEntries keys, snapshots,
@@ -1737,10 +1768,15 @@ export class GatewayProvider {
             return this.balance;
         }
     }
-    async fetchFreshOpenOrders() {
+    /** Strict fresh read — null on ANY failure (missing tool, thrown fetch,
+     *  non-array garbage). Callers whose verdict claims order-state coverage
+     *  (Kill) MUST distinguish "confirmed list" from "unknown"; collapsing a
+     *  failed read into the ≤60s cache here was how a stale-empty cache became
+     *  a green "No open orders to cancel" (audit 2026-07-26 F6). */
+    async fetchFreshOpenOrdersOrNull() {
         const tool = this.toolMap.fetch_open_orders;
         if (!tool || !this.http)
-            return this.openOrders;
+            return null;
         try {
             // Fetch ALL open orders (no symbol filter). Multi-symbol orphan orders
             // submitted while the browser was disconnected must show up in the
@@ -1749,7 +1785,7 @@ export class GatewayProvider {
             const result = await this.http.invoke(tool, {});
             if (!Array.isArray(result.data)) {
                 logger.warn(TAG, `fetch_open_orders returned non-array: ${typeof result.data}`);
-                return this.openOrders;
+                return null;
             }
             const mapped = result.data
                 .map((o) => mapCcxtOrder(o))
@@ -1761,10 +1797,15 @@ export class GatewayProvider {
             return mapped;
         }
         catch (err) {
-            logger.warn(TAG, `Fresh open orders fetch failed, using cached: ${err instanceof Error ? err.message : String(err)}`);
-            return this.openOrders;
+            logger.warn(TAG, `Fresh open orders fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
         }
     }
+    /** Cached-fallback wrapper for DISPLAY surfaces (the reconcile snapshot):
+     *  stale data beats a blank panel there. Never use for emergency verdicts. */
+    async fetchFreshOpenOrders() {
+        return (await this.fetchFreshOpenOrdersOrNull()) ?? this.openOrders;
+    }
     async fetchAgentHealth() {
         const ws = this.wsClient;
         if (!ws)
@@ -2309,7 +2350,13 @@ export class GatewayProvider {
         const url = this.config.intelligenceUrl;
         const token = this.config.connectionToken;
         if (!url || !token) {
-            logger.debug(TAG, 'Intelligence not configured — skipping trade result report');
+            // NEVER debug-level. This is the only writer of intel's `trade_results`,
+            // and those rows are what `minTradesForKelly` counts and what
+            // `get_agent_profile` derives its tier from. Silently skipping here is
+            // indistinguishable from "the agent has never traded" — which is exactly
+            // how it read for months. See DEFAULT_INTELLIGENCE_URL in gateway-config.
+            logger.warn(TAG, `Intelligence not configured (url=${url ? 'set' : 'MISSING'}, token=${token ? 'set' : 'MISSING'}) — DROPPING trade result for ${symbol}. `
+                + 'Kelly sizing and the agent profile are computed from these rows and will stay pinned at their no-history defaults.');
             return;
         }
         const direction = entry.side === 'long' ? 'LONG' : 'SHORT';
@@ -2321,7 +2368,7 @@ export class GatewayProvider {
         const durationSeconds = Math.floor((Date.now() - new Date(entry.entryTime).getTime()) / 1000);
         const tradeResult = {
             missionId: entry.missionId ?? `trade-${Date.now()}`,
-            symbol: symbol.replace('/', ''), // BTC/USDT → BTCUSDT for Intelligence API
+            symbol: this.toIntelSymbol(symbol), // venue-aware: BTC/USDT → BTCUSDT, BTC/USDC → HL_BTC
             direction,
             strategy: this.lastKnownStrategy.name,
             regime: entry.regime ?? this.currentRegime,
@@ -2406,9 +2453,9 @@ export class GatewayProvider {
         }
     }
     // ---- Intelligence service polling ----
-    /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */
+    /** The configured symbol as the intel DB spells it. */
     get intelligenceSymbol() {
-        return this.config.symbol.replace('/', '');
+        return this.toIntelSymbol(this.config.symbol);
     }
     /** Shared intelligence poller with circuit-breaker (exponential backoff on errors). */
     startIntelligencePoller(name, endpoint, intervalMs, onData, intervalRef, delayFirstMs = 0) {
@@ -2420,6 +2467,21 @@ export class GatewayProvider {
             }
             return;
         }
+        // These five read-pollers (regime 60s, signals 10s, missions 10s,
+        // analytics 30s, decision-trace 30s ≈ 22 req/min per box) were dormant for
+        // as long as `intelligenceUrl` had no default. Giving it one turns them on
+        // everywhere, which is the intended behaviour — they feed the dashboard's
+        // regime/signals/missions panels — but it IS new load on an intel API with
+        // a known heap leak. Kill-switch so that load can be shed in one restart
+        // WITHOUT taking the trade_results writer down with it: the writer is what
+        // Kelly sizing and the agent tier are computed from, and it does not go
+        // through this function.
+        if (process.env.RC_SKILL_INTEL_POLL === 'off') {
+            if (name === 'regime') {
+                logger.warn(TAG, 'RC_SKILL_INTEL_POLL=off — intelligence read-polling disabled (trade-result reporting is unaffected)');
+            }
+            return;
+        }
         const symbol = this.intelligenceSymbol;
         const fullUrl = `${url}/api/${endpoint}/${symbol}`;
         logger.info(TAG, `Starting ${name} poller: ${fullUrl}`);

package/assets/bridge/providers/onboarding-commands.d.ts

@@ -38,6 +38,14 @@ export interface ClearExchangeCredentialsOutcome {
 export interface OnboardingContext {
     http: GatewayHttpClient | null;
     toolMap: ToolMap;
+    /** rc_* connection token, injected as `operator_token` on the four
+     *  state-MUTATING operator tools (set_trading_mode /
+     *  set_exchange_credentials / clear_exchange_credentials /
+     *  set_bracket_requirement). The plugin refuses those calls without it
+     *  (audit 2026-07-26 F12) — this is the operator-provenance proof that the
+     *  request came through the dashboard path, which the agent cannot forge
+     *  conversationally (chat redaction strips rc_* tokens). */
+    operatorToken?: string;
 }
 export type BracketMode = 'off' | 'observe' | 'enforce';
 export type BracketRequirementFlag = 'requireStopLoss' | 'requireTakeProfit';

package/assets/bridge/providers/onboarding-commands.js

@@ -23,7 +23,7 @@ export async function executeSetTradingMode(ctx, mode, acknowledged) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { mode, acknowledged });
+        const result = await ctx.http.invoke(tool, { mode, acknowledged, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -93,7 +93,7 @@ export async function executeClearExchangeCredentials(ctx) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { confirm: true });
+        const result = await ctx.http.invoke(tool, { confirm: true, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -162,7 +162,7 @@ export async function executeSetBracketRequirement(ctx, flag, value) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { flag, value });
+        const result = await ctx.http.invoke(tool, { flag, value, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -194,7 +194,7 @@ export async function executeSetExchangeCredentials(ctx, apiKey, secret, testnet
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet });
+        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {

package/assets/plugin/ccxt/binance-public.d.ts

@@ -1,3 +1,4 @@
+import { type VenueReachabilityResult } from '@reefclaw/shared';
 import type { CcxtTicker, CcxtOHLCV } from '../types.js';
 import type { OrderBookDepth } from '../simulator/types.js';
 import type { PublicMarketDataApi } from './public-market-data-api.js';
@@ -28,9 +29,20 @@ export declare class BinancePublicApi implements PublicMarketDataApi {
      *   - 'reachable'   clean response (driftMs = serverTime − localTime)
      *   - 'geo_blocked' HTTP 451 — host is in a restricted region (actionable)
      *   - 'unknown'     the ban/weight gate paused us — NOT a host problem
-     *   - 'unreachable' network / DNS / timeout / other error */
-    probeReachability(): Promise<{
-        outcome: 'reachable' | 'geo_blocked' | 'unreachable' | 'unknown';
-        driftMs: number | null;
-    }>;
+     *   - 'stalled'     THIS process was starved — we learned nothing (issue #265)
+     *   - 'unreachable' network / DNS / timeout / other error
+     *
+     *  ★ Self-stall detection: an error is evidence about BINANCE only if it
+     *  arrived on schedule. When the host starves the process the loop stops
+     *  running, ccxt's own timeout lands minutes late, and the old code blamed the
+     *  network — producing a confident "you are geo-blocked / check your firewall"
+     *  banner while the agent was in fact trading normally. Past
+     *  REACHABILITY_STALL_FACTOR× the request budget we report `stalled` and the
+     *  reporter renders it `unknown`. A 451 still wins: the server ANSWERED, so
+     *  that classification stands however late we noticed it. */
+    probeReachability(): Promise<VenueReachabilityResult>;
+    /** The request budget the stall yardstick is measured against. ccxt owns the
+     *  actual timeout, so read it from the instance rather than hardcoding a
+     *  second copy that could silently drift from it. */
+    private probeTimeoutMs;
 }