@reefclaw/connect 0.1.20 → 0.1.22

package/assets/plugin/strategy/condition-registry.js

@@ -36,20 +36,27 @@ register('oi_slope', (fact) => ({
     name: 'oi_slope',
     met: fact.conditions.oi_slope_up ?? false,
 }));
-// 5. no_liquidation_cluster — always passes in scan context (no live data)
+// 5. no_liquidation_cluster — FAIL-OPEN PLACEHOLDER in scan context: the
+// fact-computer ships no liquidation data, so this preview cannot evaluate
+// it. `note` marks the gap explicitly (never a silent pass); the
+// authoritative evaluation runs in the central signal engine, which reads the
+// live liquidation-levels feed.
 register('no_liquidation_cluster', () => ({
     name: 'no_liquidation_cluster',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 6. price_sweep
 register('price_sweep', (fact) => ({
     name: 'price_sweep',
     met: (fact.conditions.price_sweep_high ?? false) || (fact.conditions.price_sweep_low ?? false),
 }));
-// 7. liquidations_at_sweep — always passes in scan context
+// 7. liquidations_at_sweep — FAIL-OPEN PLACEHOLDER in scan context, same gap
+// and same note contract as no_liquidation_cluster above.
 register('liquidations_at_sweep', () => ({
     name: 'liquidations_at_sweep',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 8. order_flow_absorption
 register('order_flow_absorption', (fact) => ({

package/assets/plugin/strategy/evaluator.d.ts

@@ -45,6 +45,11 @@ export interface ConditionEvalResult {
     name: string;
     met: boolean;
     value?: number;
+    /** Set when `met` is a fail-open placeholder rather than a real evaluation
+     *  (e.g. the scan facts carry no data for this condition). Surfaces the gap
+     *  to any consumer instead of letting a pass silently impersonate a check —
+     *  the authoritative evaluation runs in the central signal engine. */
+    note?: string;
 }
 export interface StrategyEvalResult {
     strategy: string;

package/assets/plugin/tools/attach-brackets.js

@@ -323,13 +323,28 @@ async function attachBracketsHl(args, adapter) {
     let clearedStaleLedgerRow = false;
     if (existing && !isTerminalBracketState(existing.state)) {
         let cls = 'unknown';
+        // Per-LEG liveness (audit 2026-07-26 F4): "either cid survives ⇒ live"
+        // let a TP-only position no-op as "already protected" indefinitely while
+        // its stop was gone. A registered leg positively absent from a NON-EMPTY
+        // order set is a protection gap this tool must repair, not paper over.
+        const missingLegs = [];
         const hasCids = Boolean(existing.slCid || existing.tpCid);
         if (hasCids) {
             try {
                 const open = await adapter.getOpenOrders(position.symbol);
                 const liveCids = new Set(open.map(o => o.clientOrderId).filter(Boolean));
-                if ((existing.slCid && liveCids.has(existing.slCid)) || (existing.tpCid && liveCids.has(existing.tpCid))) {
+                const stopLive = Boolean(existing.slCid && liveCids.has(existing.slCid));
+                const tpLive = Boolean(existing.tpCid && liveCids.has(existing.tpCid));
+                if (stopLive || tpLive) {
                     cls = 'live';
+                    if (open.length > 0) {
+                        // Non-empty set = positive evidence for absence (d59e51b) — a
+                        // registered-but-absent sibling is a repairable gap.
+                        if (existing.slCid && !stopLive)
+                            missingLegs.push('stop');
+                        if (existing.tpCid && !tpLive)
+                            missingLegs.push('target');
+                    }
                 }
                 else if (open.length > 0) {
                     cls = 'stale'; // non-empty set positively lacking our cids
@@ -351,6 +366,40 @@ async function attachBracketsHl(args, adapter) {
         if (cls === 'live') {
             if (pricesMatch(args.stop_price, existing.stopPrice)
                 && pricesMatch(args.target_price, existing.targetPrice)) {
+                if (missingLegs.length > 0) {
+                    // One registered leg is positively gone (a stop-less position is a
+                    // safety-floor breach). Rebuild it at the registered price via the
+                    // resize path — planResize submits ONLY the missing leg and leaves
+                    // the healthy sibling untouched (F4).
+                    try {
+                        const coordinator = adapter.getHlBracketCoordinator();
+                        await coordinator.resizeToPosition(position.symbol, contracts);
+                        const healed = ledger.getBySymbol(position.symbol);
+                        return {
+                            ok: true,
+                            symbol: position.symbol,
+                            bracket_id: existing.bracketId,
+                            entry_side: entrySide,
+                            stop_price: existing.stopPrice,
+                            target_price: existing.targetPrice,
+                            sl_cid: healed?.slCid ?? existing.slCid,
+                            tp_cid: healed?.tpCid ?? existing.tpCid,
+                            attach_latency_ms: 0,
+                            cancelled_stale_bracket_orders: 0,
+                            cleared_stale_ledger_row: false,
+                            attempts: 1,
+                            idempotent_no_op: false,
+                            note: `Missing ${missingLegs.join('+')} leg re-attached at the registered price(s); sibling leg untouched.`,
+                        };
+                    }
+                    catch (err) {
+                        return {
+                            error: `Registered ${missingLegs.join('+')} leg is GONE from the exchange and the rebuild ` +
+                                `failed (${formatError(err)}). The position is under-protected — retry attach_brackets ` +
+                                `next heartbeat; the 60s truth sweep also retries. Do NOT record a protected review.`,
+                        };
+                    }
+                }
                 return {
                     ok: true,
                     symbol: position.symbol,

package/assets/plugin/tools/cancel-all-orders.js

@@ -1,5 +1,13 @@
 // Tool: cancel_all_orders — cancel all open orders (paper or live)
-// NO readiness gate — emergency control (kill switch), must always work.
+//
+// NO readiness gate and NO confirmation prompt — BY DESIGN, not an oversight:
+// this is the safety floor's kill-switch primitive ("Hard controls NEVER
+// disabled or hidden"). Any gate added here becomes a failure mode of the
+// emergency path itself — a wedged confirmation would strand live orders
+// during the exact incident the kill switch exists for. Risk-reducing only:
+// it cancels WORKING orders; the adapter layer preserves protective bracket
+// legs (parseBracketCid skip in cancelAllOrders) so positions are never left
+// naked, and it never opens or increases exposure.
 export async function cancelAllOrdersTool(args, deps) {
     const cancel = () => deps.adapter.cancelAllOrders(args.symbol);
     return deps.adapter.isLive && deps.operationLock

package/assets/plugin/tools/create-order.js

@@ -1008,11 +1008,28 @@ export async function createOrderTool(args, deps) {
         }
         // Bracket enforcement only applies in live mode when the feature is enabled.
         // Paper mode uses the stop-watcher and doesn't care about these flags.
+        //
+        // ★ `brackets.mode` is a BINANCE-only knob — it is only ever passed to
+        // LiveAdapter, and it defaults to 'off'. Gating solely on it meant an HL
+        // live rig skipped the mandatory-stop check entirely: a stopless entry
+        // passed the gate, and HL only attaches legs when stop/target metadata is
+        // present (`wireBracketsAfterSubmit`), so the position went on the book
+        // NAKED. Venues that always enforce brackets declare it on the adapter.
         let bracketEnforcement;
-        if (deps.adapter.isLive && bracketsEnabled(loadBracketMode())) {
+        if (deps.adapter.isLive && (deps.adapter.bracketsAlwaysEnforced || bracketsEnabled(loadBracketMode()))) {
             bracketEnforcement = wave9Claimed
                 ? { requireStopLoss: true, requireTakeProfit: false }
                 : loadBracketRequirements();
+            // On a venue-enforced adapter the stop requirement is NOT operator-
+            // waivable: `requireStopLoss: false` in plugin-config is a Binance-era
+            // toggle whose documented risk assumed a watcher fallback existed. HL has
+            // none — a waved-through stopless entry would sit naked. This also keeps
+            // the gate consistent with get_bracket_config, which reports
+            // requireStopLoss=true for venue-enforced adapters. The TP flag stays
+            // operator-controlled (stop-only "let winners run" is legitimate).
+            if (deps.adapter.bracketsAlwaysEnforced) {
+                bracketEnforcement = { ...bracketEnforcement, requireStopLoss: true };
+            }
         }
         const riskCheck = preTradeRiskCheck(proposed, portfolio, getDefaultPreTradeLimits(), {
             volFactor: !deps.adapter.isLive ? deps.adapter.getSimulator().getVolFactor() : 1.0,

package/assets/plugin/tools/get-bracket-config.d.ts

@@ -3,9 +3,28 @@ export interface GetBracketConfigResult {
     mode: BracketMode;
     requireStopLoss: boolean;
     requireTakeProfit: boolean;
+    /** True when the mode reported above is the VENUE's unconditional
+     *  enforcement rather than the `brackets.mode` config value. Lets the
+     *  dashboard explain why the toggles are inert. */
+    venueEnforced?: boolean;
 }
-export declare function getBracketConfigTool(_args: Record<string, never>, deps?: {
+export interface GetBracketConfigDeps {
     configPath?: string;
-}): GetBracketConfigResult | {
+    /** Active adapter. Its `bracketsAlwaysEnforced` capability overrides the
+     *  config-file mode — see below. */
+    adapter?: {
+        readonly bracketsAlwaysEnforced?: boolean;
+    };
+}
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
+export declare function getBracketConfigTool(_args: Record<string, never>, deps?: GetBracketConfigDeps): GetBracketConfigResult | {
     error: string;
 };

package/assets/plugin/tools/get-bracket-config.js

@@ -6,13 +6,29 @@
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { getBracketMode, getBracketRequirements } from '../config/brackets-config.js';
 import { formatError } from '../logger.js';
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
 export function getBracketConfigTool(_args, deps) {
     try {
         const cfg = readPluginConfig(deps?.configPath);
-        const mode = getBracketMode(cfg);
         const req = getBracketRequirements(cfg);
+        if (deps?.adapter?.bracketsAlwaysEnforced) {
+            return {
+                mode: 'enforce',
+                requireStopLoss: true,
+                requireTakeProfit: req.requireTakeProfit,
+                venueEnforced: true,
+            };
+        }
         return {
-            mode,
+            mode: getBracketMode(cfg),
             requireStopLoss: req.requireStopLoss,
             requireTakeProfit: req.requireTakeProfit,
         };

package/assets/plugin/tools/set-trading-mode.js

@@ -4,9 +4,12 @@
 // the one-rung-at-a-time ladder. Requires valid exchange credentials for
 // any non-PAPER target. Rebuilds the adapter via runtime.reconnect().
 //
-// The agent should NOT call this tool; PR2 will enforce operator-only scope
-// in the skill. PR1 leaves the plugin-side handler functional but unguarded
-// because the caller chain is currently controlled end-to-end by the skill.
+// GUARDED at the dispatch site (plugin/src/index.ts registration): every call
+// must carry the `operator_token` provenance proof and is refused by
+// verifyOperatorProvenance without it (audit 2026-07-26 F12). The agent cannot
+// supply that token — chat redaction strips rc_* tokens — so only the
+// dashboard operator path reaches this handler. This module stays guard-free
+// by design: the check lives once, at registration, for all operator tools.
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { validateModeTransition, modeRequiresCredentials } from '../onboarding/mode-ladder.js';
 import { parseVenue } from '../venues/registry.js';

package/assets/plugin/venues/hyperliquid/hl-bracket-coordinator.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { CcxtOrder, CcxtPosition } from '../../types.js';
 import type { CloseReason } from '../../simulator/types.js';
-import type { BracketId, BracketRequest, BracketState } from '../../live/bracket-types.js';
+import type { BracketId, BracketLedgerEntry, BracketRequest, BracketState } from '../../live/bracket-types.js';
 import type { BracketLedger } from '../../live/bracket-ledger.js';
 import type { HlOrderUpdateEvent } from './hl-user-stream.js';
 /** Narrow execution surface the coordinator needs — the HyperliquidLiveAdapter
@@ -24,6 +24,11 @@ export interface HlBracketExecutor {
         symbol: string;
         positionSide: 'long' | 'short';
         positionSize: number;
+        /** Ledger-registered prices — lets resize REBUILD a vanished leg (F4). */
+        registeredPrices?: {
+            stop?: number;
+            target?: number;
+        };
     }): Promise<{
         resized: boolean;
         slCid?: string;
@@ -88,6 +93,25 @@ export declare class HlBracketCoordinator extends EventEmitter {
      *  fill signal against a non-terminal row is a warned NO-OP, never a fresh
      *  bracketId that orphans the live legs' ledger identity. */
     registerEntry(req: BracketRequest, bracketId: BracketId, entryCid: string): void;
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol: string, entryCid: string): void;
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid: string | undefined | null): BracketLedgerEntry | undefined;
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */

package/assets/plugin/venues/hyperliquid/hl-bracket-coordinator.js

@@ -32,6 +32,10 @@ import { parseHlBracketCloid } from './hl-cloid.js';
 const TAG = 'hl-bracket-coordinator';
 const DEFAULT_MAX_ATTEMPTS = 3;
 const DEFAULT_BACKOFF = (attempt) => (attempt === 1 ? 1_000 : 2_000);
+/** Cap on `extraEntryCids` so a position scaled many times cannot grow its
+ *  ledger row without bound. Oldest dropped — a cid that old has either filled
+ *  (row already resized) or been cancelled. */
+const MAX_EXTRA_ENTRY_CIDS = 20;
 const TERMINAL_STATES = new Set([
     'triggered_sl',
     'triggered_tp',
@@ -109,6 +113,12 @@ export class HlBracketCoordinator extends EventEmitter {
             logger.warn(TAG, `registerEntry(${req.symbol}): non-terminal row exists (state=${existing.state}, ` +
                 `bracketId=${existing.bracketId}) — duplicate fill signal, NOT clobbering ` +
                 `(anti-clobber contract; scale-ins go through resizeToPosition)`);
+            // ★ F5: not clobbering the row is right — DROPPING the new order's cloid
+            // was not. A duplicate signal carrying a DIFFERENT cid is a second order
+            // against the same position (a resting scale-in, or a second entry while
+            // the first is still pending); its fill has to find this row or nothing
+            // attaches/resizes for it.
+            this.registerAdditionalEntryCid(req.symbol, entryCid);
             return;
         }
         if (existing)
@@ -129,6 +139,49 @@ export class HlBracketCoordinator extends EventEmitter {
             ts: new Date(this.now()).toISOString(),
         });
     }
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol, entryCid) {
+        if (!entryCid)
+            return;
+        const row = this.ledger.getBySymbol(symbol);
+        if (!row || isTerminalBracketState(row.state))
+            return;
+        if (row.entryCid === entryCid)
+            return;
+        const current = row.extraEntryCids ?? [];
+        if (current.includes(entryCid))
+            return;
+        this.ledger.upsert({
+            ...row,
+            extraEntryCids: [...current, entryCid].slice(-MAX_EXTRA_ENTRY_CIDS),
+        });
+        logger.info(TAG, `${row.symbol}: tracking additional entry cid ${entryCid} against bracket ` +
+            `${row.bracketId} (state=${row.state}) — its fill must drive attach/resize (T-2)`);
+    }
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid) {
+        if (!cloid)
+            return undefined;
+        return this.ledger
+            .getAll()
+            .find((r) => !isTerminalBracketState(r.state) &&
+            (r.entryCid === cloid || r.extraEntryCids?.includes(cloid) === true));
+    }
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */
@@ -261,6 +314,10 @@ export class HlBracketCoordinator extends EventEmitter {
             symbol: entry.symbol,
             positionSide,
             positionSize: newPositionSize,
+            // F4: with the registered prices in hand, resize can REBUILD a leg that
+            // vanished entirely (e.g. a stripped stop) instead of no-oping while
+            // the coverage sweep warns forever.
+            registeredPrices: { stop: entry.stopPrice, target: entry.targetPrice },
         });
         if (res.resized) {
             this.ledger.markState(symbol, entry.state, {

package/assets/plugin/venues/hyperliquid/hl-brackets.d.ts

@@ -87,6 +87,16 @@ export declare function planResize(args: {
     positionSide: 'long' | 'short';
     positionSize: number;
     liveLegs: LiveLeg[];
+    /** The prices REGISTERED at attach (the ledger row's stopPrice/targetPrice).
+     *  ★ Audit 2026-07-26 F4: a role whose leg vanished entirely used to be
+     *  "the attach path's job" — but no path owned it, so a stop-less position
+     *  never self-healed. With the registered price in hand, resize REBUILDS
+     *  the missing leg at the price the agent pinned; without one it cannot
+     *  invent a level and leaves the role to the coverage alarms. */
+    registeredPrices?: {
+        stop?: number;
+        target?: number;
+    };
 }): ResizePlan;
 /** Is this exchange order one of OUR protective legs?
  *

package/assets/plugin/venues/hyperliquid/hl-brackets.js

@@ -84,6 +84,11 @@ export function bracketCoversPosition(args) {
         const legs = args.liveLegs.filter((l) => l.role === role);
         if (legs.length === 0) {
             missing.push(role);
+            // A role with no leg at all leaves the WHOLE position uncovered on that
+            // side — report the honest naked size. Leaving this at 0 was audit
+            // 2026-07-26 F4: the resize planner keyed on shortfall, saw zero, and
+            // no-oped forever while a stop-less position stayed naked.
+            shortfall[role] = args.positionSize;
             continue;
         }
         const coveredSize = legs.reduce((sum, l) => sum + l.size, 0);
@@ -91,12 +96,15 @@ export function bracketCoversPosition(args) {
         if (gap > COVERAGE_EPSILON)
             shortfall[role] = gap;
     }
-    const covered = shortfall.stop <= COVERAGE_EPSILON &&
-        shortfall.target <= COVERAGE_EPSILON &&
-        // A missing STOP is never "covered" — that is the naked-position case. A
-        // missing TARGET is a policy choice (requireTakeProfit can be off), so it is
-        // reported in `missing` but does not by itself fail coverage.
-        !missing.includes('stop');
+    const covered = 
+    // A missing STOP is never "covered" — that is the naked-position case
+    // (its shortfall is the full position size, so this arm also fails).
+    !missing.includes('stop') &&
+        shortfall.stop <= COVERAGE_EPSILON &&
+        // A missing TARGET is a policy choice (requireTakeProfit can be off): it
+        // is reported via `missing` + `shortfall` but does not by itself fail
+        // coverage. A PRESENT-but-undersized target still does.
+        (missing.includes('target') || shortfall.target <= COVERAGE_EPSILON);
     return { covered, shortfall, missing };
 }
 /** ★ Resize protective legs after a scale-in (or any position-size change).
@@ -120,20 +128,44 @@ export function planResize(args) {
         positionSize: args.positionSize,
         liveLegs: args.liveLegs,
     });
-    // Nothing to do when every present leg already covers the position exactly.
+    const healable = ['stop', 'target'].filter((role) => {
+        const price = args.registeredPrices?.[role];
+        return (coverage.missing.includes(role) &&
+            typeof price === 'number' && Number.isFinite(price) && price > 0);
+    });
+    // Nothing to do when every present leg already covers the position exactly
+    // and no vanished-but-registered leg needs rebuilding. (A missing role's
+    // shortfall is the full position size, so present-leg sizing is checked
+    // against the PRESENT legs only.)
+    const presentShortfall = ['stop', 'target'].some((role) => !coverage.missing.includes(role) && coverage.shortfall[role] > COVERAGE_EPSILON);
     const oversized = args.liveLegs.some((l) => l.size - args.positionSize > COVERAGE_EPSILON);
-    if (coverage.shortfall.stop <= COVERAGE_EPSILON &&
-        coverage.shortfall.target <= COVERAGE_EPSILON &&
-        !oversized) {
+    if (!presentShortfall && !oversized && healable.length === 0) {
         return { cancelCloids: [], submit: [], noop: true };
     }
-    // Rebuild every PRESENT role at the correct size, preserving its trigger price.
+    // Rebuild every PRESENT role at the correct size (preserving its trigger
+    // price), plus every HEALABLE missing role at its registered price.
     const legs = [];
     const cancelCloids = [];
     for (const role of ['stop', 'target']) {
         const existing = args.liveLegs.filter((l) => l.role === role);
-        if (existing.length === 0)
-            continue; // absent leg = attach path's job, not resize's
+        if (existing.length === 0) {
+            if (!healable.includes(role))
+                continue; // no leg, no registered price — coverage alarms own it
+            legs.push({
+                role,
+                triggerPrice: args.registeredPrices[role],
+                size: args.positionSize,
+                cloid: buildHlBracketCloid(args.bracketId, role),
+            });
+            continue;
+        }
+        // A present role that already covers exactly (and isn't oversized) is left
+        // untouched — a heal of the OTHER role must not churn a healthy leg.
+        const coveredSize = existing.reduce((sum, l) => sum + l.size, 0);
+        const roleHealthy = args.positionSize - coveredSize <= COVERAGE_EPSILON &&
+            !existing.some((l) => l.size - args.positionSize > COVERAGE_EPSILON);
+        if (roleHealthy)
+            continue;
         // Trigger price is preserved from the live leg (the agent's pinned plan) —
         // resizing must NEVER silently move a stop.
         const triggerPrice = existing[0].triggerPrice;

package/assets/plugin/venues/hyperliquid/hl-fill-ingest.d.ts

@@ -0,0 +1,18 @@
+import type { FillEvent } from '@reefclaw/shared';
+import type { HlFillEvent } from './hl-user-stream.js';
+/** Inverse of shared `toHyperliquidCoin`: every HL perp is USDC-quoted, so the
+ *  canonical symbol is `<coin>/USDC` with the coin's case preserved (kPEPE). */
+export declare function hlCoinToCanonical(coin: string): string;
+/**
+ * Map one HL fill to the shared FillEvent contract.
+ *
+ * Returns null (with a warn) when the identity fields the audit trail's
+ * idempotency key needs are absent or garbled — a row we cannot key must be
+ * dropped, never fabricated. `exchange` MUST come from
+ * `fillExchangeId('hyperliquid')` (FILL_EXCHANGE_ID strings are frozen once
+ * rows exist) — this mapper trusts the wiring, it does not mint literals.
+ */
+export declare function hlFillToFillEvent(fill: Partial<HlFillEvent>, wiring: {
+    userId: string;
+    exchange: string;
+}, source: 'ws' | 'rest_reconcile'): FillEvent | null;

package/assets/plugin/venues/hyperliquid/hl-fill-ingest.js

@@ -0,0 +1,88 @@
+// Per-fill audit-trail ingest for the Hyperliquid venue (audit 2026-07-26 F26).
+//
+// Binance fills reach the `trades` table via ws-ingest (ORDER_TRADE_UPDATE →
+// FillEvent → TradeStoreClient). HL's user stream had no equivalent: fills
+// drove bracket wiring and were then DROPPED — a live book and P&L with no
+// independent per-trade record, nothing to reconcile against when a number
+// looks wrong, and fills during a WS gap lost forever. This module is the HL
+// analog: a pure mapper from the WS fill shape (also satisfied by REST
+// `userFillsByTime` rows) to the shared FillEvent contract. The adapter calls
+// it from the WS hot path and from the reconnect gap backfill; idempotency is
+// the server-side (exchange, exchange_trade_id) upsert, so double-delivery
+// between the two paths is harmless by design.
+import { logger } from '../../logger.js';
+const TAG = 'hl-fill-ingest';
+/** Inverse of shared `toHyperliquidCoin`: every HL perp is USDC-quoted, so the
+ *  canonical symbol is `<coin>/USDC` with the coin's case preserved (kPEPE). */
+export function hlCoinToCanonical(coin) {
+    return `${coin}/USDC`;
+}
+const num = (v) => {
+    const n = typeof v === 'string' ? Number(v) : typeof v === 'number' ? v : Number.NaN;
+    return Number.isFinite(n) ? n : undefined;
+};
+/**
+ * Map one HL fill to the shared FillEvent contract.
+ *
+ * Returns null (with a warn) when the identity fields the audit trail's
+ * idempotency key needs are absent or garbled — a row we cannot key must be
+ * dropped, never fabricated. `exchange` MUST come from
+ * `fillExchangeId('hyperliquid')` (FILL_EXCHANGE_ID strings are frozen once
+ * rows exist) — this mapper trusts the wiring, it does not mint literals.
+ */
+export function hlFillToFillEvent(fill, wiring, source) {
+    const price = num(fill.px);
+    const quantity = num(fill.sz);
+    const time = num(fill.time);
+    if (typeof fill.tid !== 'number' || !Number.isFinite(fill.tid) ||
+        typeof fill.oid !== 'number' || !Number.isFinite(fill.oid) ||
+        typeof fill.coin !== 'string' || fill.coin.length === 0 ||
+        price === undefined || quantity === undefined || quantity <= 0 ||
+        time === undefined ||
+        (fill.side !== 'A' && fill.side !== 'B')) {
+        // Log the DIAGNOSIS (which identity fields failed + what shape arrived),
+        // never the raw payload — fills carry account trading data that doesn't
+        // belong in journals.
+        const bad = [];
+        if (typeof fill.tid !== 'number' || !Number.isFinite(fill.tid))
+            bad.push('tid');
+        if (typeof fill.oid !== 'number' || !Number.isFinite(fill.oid))
+            bad.push('oid');
+        if (typeof fill.coin !== 'string' || fill.coin.length === 0)
+            bad.push('coin');
+        if (price === undefined)
+            bad.push('px');
+        if (quantity === undefined || quantity <= 0)
+            bad.push('sz');
+        if (time === undefined)
+            bad.push('time');
+        if (fill.side !== 'A' && fill.side !== 'B')
+            bad.push('side');
+        logger.warn(TAG, `Dropping unmappable HL fill (source=${source}): invalid=[${bad.join(',')}] ` +
+            `keys=[${Object.keys(fill).join(',')}]`);
+        return null;
+    }
+    return {
+        exchange: wiring.exchange,
+        exchangeTradeId: String(fill.tid),
+        exchangeOrderId: String(fill.oid),
+        clientOrderId: typeof fill.cloid === 'string' && fill.cloid.length > 0 ? fill.cloid : undefined,
+        source,
+        userId: wiring.userId,
+        symbol: hlCoinToCanonical(fill.coin),
+        side: fill.side === 'B' ? 'BUY' : 'SELL',
+        quantity,
+        price,
+        // HL `crossed` is the taker flag; maker is its inverse. Absent → unknown.
+        maker: typeof fill.crossed === 'boolean' ? !fill.crossed : undefined,
+        // `fee` is inclusive of builderFee, and we hard-disable the builder fee
+        // (options.builderFee:false, pinned by hl-private.test.ts) so this is the
+        // whole commission either way. HL fees settle in USDC unless feeToken says
+        // otherwise.
+        commission: num(fill.fee),
+        commissionAsset: typeof fill.feeToken === 'string' ? fill.feeToken : 'USDC',
+        realizedPnl: num(fill.closedPnl),
+        exchangeTime: time,
+        rawPayload: fill,
+    };
+}