@reefclaw/connect 0.1.31 → 0.1.32

package/assets/bridge/connector.d.ts

@@ -22,7 +22,9 @@ export declare class Connector {
     private lastMessageAt;
     private destroyed;
     constructor(config: ConnectorConfig, callbacks: ConnectorCallbacks);
-    /** Build the relay WebSocket URL (token is sent via Authorization header, not URL) */
+    /** Build the relay WebSocket URL (token is sent via Authorization header, not
+     *  URL; the instance id is non-secret and rides the query string so the
+     *  relay's skill-slot admission can recognise a same-box restart). */
     private buildUrl;
     /** Start connecting to the relay */
     connect(): void;

package/assets/bridge/connector.js

@@ -37,10 +37,15 @@ export class Connector {
         this.reconnectConfig = { ...DEFAULT_RECONNECT, ...config.reconnect };
         this.heartbeatConfig = { ...DEFAULT_HEARTBEAT };
     }
-    /** Build the relay WebSocket URL (token is sent via Authorization header, not URL) */
+    /** Build the relay WebSocket URL (token is sent via Authorization header, not
+     *  URL; the instance id is non-secret and rides the query string so the
+     *  relay's skill-slot admission can recognise a same-box restart). */
     buildUrl() {
         const base = this.config.relayUrl.replace(/\/$/, '');
-        return `${base}/parties/reefclaw/${this.config.userId}`;
+        const path = `${base}/parties/reefclaw/${this.config.userId}`;
+        return this.config.instanceId
+            ? `${path}?instance=${encodeURIComponent(this.config.instanceId)}`
+            : path;
     }
     /** Start connecting to the relay */
     connect() {
@@ -96,6 +101,24 @@ export class Connector {
                 }, 15 * 60_000);
                 return;
             }
+            // 4011 = another agent holds this account's skill slot and is alive
+            // (relay skill-slot admission, 2026-08-25 — the fix for the 4010
+            // ping-pong two bridges used to fight). Retrying fast is pointless and
+            // noisy: the seated agent keeps the slot until it stops. Slow-probe
+            // every 5 min so a deliberate box switch (stop the old one) is picked
+            // up without a manual restart here.
+            if (code === 4011) {
+                logger.error(TAG, `Relay refused this connection (4011): another agent is already connected for this ` +
+                    `account. ReefClaw runs ONE agent per account — stop the other agent (or revoke its ` +
+                    `token in the dashboard) to move this box in. Probing again in 5 min.`);
+                this.setState('failed');
+                this.attempt = 0;
+                this.reconnectTimer = setTimeout(() => {
+                    this.reconnectTimer = null;
+                    this.connect();
+                }, 5 * 60_000);
+                return;
+            }
             // 4002 = stale skill connection on relay. Wait for it to time out, then retry.
             if (code === 4002) {
                 logger.warn(TAG, 'Stale skill connection on relay — waiting 10s before retry');
@@ -275,6 +298,18 @@ export class Connector {
             // Send a native WebSocket ping (protocol-level, handled by PartyKit automatically).
             if (this.ws && this.ws.readyState === WebSocket.OPEN) {
                 this.ws.ping();
+                // App-level keepalive: native pings are absorbed by the PartyKit
+                // runtime and never reach the relay DO, so an idle-but-healthy agent
+                // would look dead to the skill-slot admission's liveness window and
+                // could be evicted by a second box's probe. One tiny frame per
+                // heartbeat tick keeps the seat provably occupied; the relay swallows
+                // it (never forwarded to browsers, never audited).
+                this.ws.send(JSON.stringify({
+                    type: 'event',
+                    event: 'skill_keepalive',
+                    channel: 'agent_state',
+                    payload: { ts: Date.now() },
+                }));
             }
         }, this.heartbeatConfig.intervalMs);
         logger.debug(TAG, `Heartbeat started: interval=${this.heartbeatConfig.intervalMs}ms timeout=${this.heartbeatConfig.timeoutMs}ms`);

package/assets/bridge/gateway/heartbeat-cron.js

@@ -49,7 +49,8 @@ export const HEARTBEAT_MESSAGE = 'Heartbeat. Execute EVERY checkbox in the HEART
     'do NOT re-read SKILL.md from disk unless preparing a NEW entry). ' +
     'NON-SKIPPABLE every beat: (1) query_trades({hours:1}) stop-watcher reconcile; ' +
     '(2) get_wave9_status() once, unconditionally; ' +
-    '(3) if ANY position is open: get_my_recent_reviews() + get_relevant_learnings({applies_at: heartbeat}) in one batch, ' +
+    '(3) if ANY position is open and the Position Decision Journal is enabled (record_position_reviews reports off-mode when it is not): ' +
+    'get_my_recent_reviews() + get_relevant_learnings({applies_at: heartbeat}) in one batch, ' +
     'then record_position_reviews with ONE review per open position, ' +
     'plus get_resting_liquidity + get_liquidation_levels + get_liquidation_pulse for ALL positions in one parallel batch; ' +
     '(4) the Market Assessment reads. ' +

package/assets/bridge/index.js

@@ -17,6 +17,7 @@ import { GatewayProvider } from './providers/gateway.js';
 import { resolveConfig } from './config.js';
 import { resolveGatewayConfig, validateGatewayConfig } from './gateway/gateway-config.js';
 import { runSetup } from './setup.js';
+import { resolveRelayInstanceId } from './utils/instance-id.js';
 const TAG = 'main';
 // ---- Load .env file (skill/.env only) ----
 function loadEnvFile() {
@@ -223,6 +224,9 @@ async function main() {
         relayUrl,
         userId,
         token,
+        // Stable per-install id → the relay's skill-slot admission recognises a
+        // same-box restart (instant takeover) vs a second box (rejected 4011).
+        instanceId: resolveRelayInstanceId(),
     };
     const bridge = new Bridge(provider, connectorConfig);
     // Handle graceful shutdown

package/assets/bridge/types.d.ts

@@ -602,6 +602,10 @@ export interface ConnectorConfig {
     relayUrl: string;
     userId: string;
     token: string;
+    /** Stable per-install id (non-secret), sent as `?instance=` so the relay's
+     *  skill-slot admission can tell "same box restarting" (instant takeover)
+     *  from "second box" (rejected 4011). See utils/instance-id.ts. */
+    instanceId?: string;
     reconnect?: {
         baseDelayMs?: number;
         maxDelayMs?: number;

package/assets/bridge/utils/instance-id.d.ts

@@ -0,0 +1,3 @@
+/** Read-or-create the stable instance id. `baseDir` overrides the storage
+ *  directory (tests; defaults to ~/.reefclaw). Never throws. */
+export declare function resolveRelayInstanceId(baseDir?: string): string;

package/assets/bridge/utils/instance-id.js

@@ -0,0 +1,48 @@
+// Stable per-install relay instance id (2026-08-25, skill-slot admission).
+//
+// The relay seats ONE skill connection per account and refuses newcomers —
+// EXCEPT a newcomer proving it is the same box restarting, which takes over
+// instantly (the graceful-restart property). "Same box" = this id, sent as a
+// non-secret `?instance=` query param on the relay URL. It must therefore
+// survive process restarts: persisted once per install at
+// `~/.reefclaw/relay-instance-id` and reused forever.
+//
+// Fail-open: when the filesystem refuses (read-only home, exotic container),
+// fall back to a per-process id. Takeover-after-crash then degrades to the
+// relay's liveness timeout instead of being instant — worse, never wrong.
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { logger } from '../logger.js';
+const TAG = 'instance-id';
+const ID_SHAPE = /^[A-Za-z0-9-]{8,64}$/;
+/** Read-or-create the stable instance id. `baseDir` overrides the storage
+ *  directory (tests; defaults to ~/.reefclaw). Never throws. */
+export function resolveRelayInstanceId(baseDir) {
+    // Operator escape hatch (e.g. two deliberate installs sharing one home dir).
+    const fromEnv = process.env.RC_RELAY_INSTANCE_ID?.trim();
+    if (fromEnv && ID_SHAPE.test(fromEnv))
+        return fromEnv;
+    const dir = baseDir ?? join(homedir(), '.reefclaw');
+    const file = join(dir, 'relay-instance-id');
+    try {
+        if (existsSync(file)) {
+            const existing = readFileSync(file, 'utf8').trim();
+            if (ID_SHAPE.test(existing))
+                return existing;
+            // Garbled file: fall through and rewrite — a fresh id only costs one
+            // liveness-timeout takeover, a garbled param corrupts the admission key.
+        }
+        const fresh = randomUUID();
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(file, fresh + '\n', 'utf8');
+        return fresh;
+    }
+    catch (err) {
+        const perProcess = randomUUID();
+        logger.warn(TAG, `Could not persist relay instance id (${err.message}) — using per-process id; ` +
+            `crash takeover degrades to the relay liveness timeout`);
+        return perProcess;
+    }
+}

package/assets/plugin/index.js

@@ -1418,6 +1418,11 @@ const paperTradingPlugin = {
                             // F26: same wiring object as the Binance arm — the SIGTERM
                             // drain covers both venues because it drains this client.
                             tradeIngest,
+                            // Journal close capture (close-bypass fix, HL arm): without
+                            // this, every bracket SL/TP fill leaked as status='open'
+                            // until the reconciler healed it reason-less (50% of wisekid
+                            // 30d closes were reconciler_observed_flat).
+                            autoCapture,
                         },
                     }
                     : {

package/assets/plugin/ingest/position-auto-capture.js

@@ -19,7 +19,7 @@
 // that hooks into the WS-ingest pipeline (see POSITION_DECISION_JOURNAL_PLAN
 // §5.1 for the longer-term design).
 import { logger } from '../logger.js';
-import { isBracketCid } from '../live/bracket-id.js';
+import { isBracketClientId, parseBracketClientId } from '../live/bracket-id.js';
 import { normalizeBracketSymbol } from '../live/bracket-ledger.js';
 import { fillPriceFromOrder } from '../live/fill-price.js';
 import { getSkillVersionCached, withSkillVersion } from './skill-version-reader.js';
@@ -627,7 +627,13 @@ async function handleReduceOnlyExit(ctx, fill) {
     // onClosePositionFilled) or a manual/external close — both are handled by
     // their own paths (close_position's rich reason+assessment, or the reconciler
     // backstop). Closing here would clobber the agent's close reasoning, so defer.
-    const isBracket = fill.clientOrderId ? isBracketCid(fill.clientOrderId) : false;
+    // Recognition is VENUE-DISPATCHED (bracket-id rule): Binance `bkt…`/`rc-…`
+    // cids, Hyperliquid `0xbc7…` cloids — the Binance-only check silently
+    // classed every HL bracket fill as external and deferred it forever.
+    const cidVenue = ctx.venue ?? 'binance';
+    const isBracket = fill.clientOrderId
+        ? isBracketClientId(cidVenue, fill.clientOrderId)
+        : false;
     if (!isBracket) {
         logger.info(TAG, `${fill.symbol} flat via non-bracket reduce-only fill (cid=${fill.clientOrderId ?? 'none'}) — ` +
             `deferring close to close_position / reconciler backstop (no clobber)`);
@@ -643,6 +649,12 @@ async function handleReduceOnlyExit(ctx, fill) {
                 'Auto-journaled from the WS fill — no close_position call (close-bypass path).',
             observedFrom: 'ws_reduce_only_fill',
             clientOrderId: fill.clientOrderId,
+            // Which protective leg fired ('stop' | 'target'), parsed from the cid.
+            // Kept in the assessment (not a new close reason) so the close_reason
+            // vocabulary stays stable for the miner's plan-adherence classifier.
+            leg: fill.clientOrderId
+                ? parseBracketClientId(cidVenue, fill.clientOrderId)?.role
+                : undefined,
         },
         scorecardVerdict: 'NO_GO',
         confluenceScore: 0,

package/assets/plugin/onboarding/runtime.js

@@ -63,6 +63,10 @@ export function buildAdapter(input) {
                 marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
                 microLive,
                 tradeIngest,
+                // Journal close capture (close-bypass fix) — same wiring the boot
+                // path passes; omitting it here would shed the capture on every
+                // reconnect-built adapter (the F9 class).
+                autoCapture: input.wiring?.autoCapture,
             },
         });
     }

package/assets/plugin/simulator/exchange-simulator.d.ts

@@ -76,7 +76,11 @@ export declare class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice?: number): CcxtOrder;
+    referencePrice?: number, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit?: boolean): CcxtOrder;
     cancelOrder(orderId: string): CcxtOrder;
     cancelAllOrders(symbol?: string): CcxtOrder[];
     /**

package/assets/plugin/simulator/exchange-simulator.js

@@ -290,17 +290,29 @@ export class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice) {
+    referencePrice, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
         // selling positions before the session is cleared and the agent re-reads SKILL.md.
         // Only activates when positions exist (nothing to protect if starting empty).
+        // Protective exits pass through: a stop breached 3s after a restart must
+        // close NOW — blocking the watcher here left positions unprotected for
+        // the whole window (open item since 2026-07-27).
         const elapsed = Date.now() - this.startupTime;
         if (this.hadPositionsAtStartup && elapsed < ExchangeSimulator.STARTUP_LOCKOUT_MS) {
-            const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
-            logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
-            throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            if (protectiveExit) {
+                logger.info(TAG, `Startup lockout bypassed for protective exit: ${side} ${amount} ${symbol}`);
+            }
+            else {
+                const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
+                logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
+                throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            }
         }
         if (amount <= 0) {
             throw new Error('Order amount must be positive');
@@ -410,9 +422,15 @@ export class ExchangeSimulator extends EventEmitter {
         if (closeReason) {
             position.metadata = { ...(position.metadata ?? {}), closeReason };
         }
-        // Create opposing market order to close the position
+        // Create opposing market order to close the position.
+        // Mechanical / operator-initiated exits (stop_watcher, exchange_target,
+        // emergency, operator, bracket_attach_failed, …) must never wait out the
+        // startup lockout — a stop breached seconds after a restart has to close
+        // immediately. Only discretionary closes ('agent' or reason-less) keep
+        // the stale-session guard.
+        const protectiveExit = closeReason !== undefined && closeReason !== 'agent';
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice, protectiveExit);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip

package/assets/plugin/tools/close-position.js

@@ -317,9 +317,18 @@ export async function closePositionTool(args, deps) {
                         'Use get_wave9_status for a reversal authorization or operator_command for an emergency close.');
                 }
             }
+            // Thread the validated reason to the adapter as its CloseReason:
+            // 'operator_command' maps to 'operator' so an operator-driven close is
+            // never caught by the paper startup lockout (whose protective-exit
+            // carve-out keys on the reason — before this, the tool dropped the
+            // reason entirely and EVERY generic close arrived as discretionary).
+            // All other reasons are agent-discretionary by design and stay subject
+            // to the lockout; the rich reason still reaches the journal via
+            // close_reason, this only fixes the adapter-level class + metadata.
+            const adapterCloseReason = args.reason === 'operator_command' ? 'operator' : 'agent';
             return wave9ExitClaimed
                 ? deps.adapter.closePosition(args.symbol, 'wave9_signal_reversal')
-                : deps.adapter.closePosition(args.symbol);
+                : deps.adapter.closePosition(args.symbol, adapterCloseReason);
         };
         const closeWave9 = async () => {
             if (!wave9Lease)

package/assets/plugin/venues/hyperliquid/hl-live-adapter.d.ts

@@ -6,6 +6,7 @@ import { type HlCredentials } from './hl-private.js';
 import type { BracketId } from '../../live/bracket-types.js';
 import { BracketLedger } from '../../live/bracket-ledger.js';
 import { HlBracketCoordinator } from './hl-bracket-coordinator.js';
+import { type AutoCaptureContext } from '../../ingest/position-auto-capture.js';
 import type { TradeIngestWiring } from '../../live/live-adapter.js';
 export interface HlLiveAdapterOptions {
     credentials: HlCredentials;
@@ -23,6 +24,16 @@ export interface HlLiveAdapterOptions {
      *  via userFillsByTime. Same object boot passes the Binance adapter —
      *  `exchange` MUST be fillExchangeId('hyperliquid'). */
     tradeIngest?: TradeIngestWiring;
+    /** Position-decision journal wiring. When present, a close-direction user-
+     *  stream fill (dir "Close …" or a liquidation fill) is routed through
+     *  `onWsFillObserved` so an exchange-native bracket SL/TP fill journals an
+     *  EXACT close (reason `bracket_fill`) instead of leaking as status='open'
+     *  until the reconciler heals it as `reconciler_observed_flat` — the HL
+     *  analog of the wiring Binance's ws-ingest has carried since PR #205.
+     *  Entry/scale-in fills are deliberately NOT routed (the sync create_order
+     *  path captures them; the WS dedup key is unverified on HL — see
+     *  onUserFill). */
+    autoCapture?: AutoCaptureContext;
     /** Test seams. Production omits both. */
     bracketLedger?: BracketLedger;
     disableUserStream?: boolean;
@@ -54,6 +65,10 @@ export declare class HyperliquidLiveAdapter extends EventEmitter implements IExc
     /** exchangeTime of the newest fill ingested (WS or backfill) — the overlap
      *  low-water mark the reconnect gap backfill widens from. */
     private lastFillIngestMs;
+    /** oid → cloid backfill for fills that omit `cloid` (the journal close path
+     *  recognizes bracket legs by client id). Populated from `orderUpdates`,
+     *  which always carries both. Bounded, insertion-order eviction. */
+    private readonly oidToCloid;
     /** UTC-midnight Day-P&L anchor (KPI-must-equal-the-HL-app, §5.8). HL has no
      *  income endpoint, so the anchor is rebuilt from userFillsByTime + userFunding
      *  each balance fetch. Without this the skill self-computes a bogus anchor and
@@ -187,10 +202,20 @@ export declare class HyperliquidLiveAdapter extends EventEmitter implements IExc
      *  `startPosition` is the position BEFORE this fill — the WS-authoritative
      *  way to know the after-fill total without an extra REST read. */
     private onUserFill;
+    /** Close-direction fill → position-decision journal (close-bypass fix, HL
+     *  arm). Fire-and-forget: a journal POST blip must never touch the WS hot
+     *  path. Reduce-only is derived from `dir` (HL fills carry no reduceOnly
+     *  flag): "Close Long"/"Close Short", plus the liquidation marker. Flip
+     *  dirs ("Long > Short") are NOT closes of a tracked side we understand —
+     *  they stay with the reconciler backstop. */
+    private captureCloseFill;
     /** `orderUpdates` is authoritative for leg lifecycle (the ALGO_UPDATE
-     *  analog). A trigger = the exchange closed the position — surface the same
+     *  analog). A trigger = the exchange closed the position — surface the
      *  `drift_detected` close shape the Binance reconciler emits so the journal
-     *  close-bypass cleanup fires at once, not ≤5 min late. */
+     *  close-bypass cleanup fires fast — but AFTER a short grace, so the close
+     *  FILL (the exact-close journal path, `captureCloseFill`) wins the
+     *  undocumented orderUpdates/userFills frame ordering. The cleanup is
+     *  idempotent: state already dropped by the fill path ⇒ no-op. */
     private onUserOrderUpdate;
     /** T-5 REST truth-check — serialized so a slow pass can't stack. */
     private runTruthCheck;

package/assets/plugin/venues/hyperliquid/hl-live-adapter.js

@@ -38,7 +38,8 @@ import { generateBracketId } from '../../live/bracket-id.js';
 import { validateStopDirection, validateTargetDirection } from '../../live/bracket-params.js';
 import { HlBracketCoordinator, isRejectedOrder, isTerminalBracketState, } from './hl-bracket-coordinator.js';
 import { HyperliquidUserStream } from './hl-user-stream.js';
-import { hlFillToFillEvent } from './hl-fill-ingest.js';
+import { hlFillToFillEvent, hlCoinToCanonical } from './hl-fill-ingest.js';
+import { onWsFillObserved } from '../../ingest/position-auto-capture.js';
 import { formatError } from '../../logger.js';
 const TAG = 'hl-live-adapter';
 /** Venue-distinct ledger storage — a venue switch on the same box must never
@@ -55,6 +56,21 @@ const DEFAULT_MARKET_SLIPPAGE = 0.005;
 /** Sticky cooldown after a failed open-orders fetch (the Binance lesson: the
  *  SKILL.md audit→attach loop re-calls every ~3s and would pin the budget). */
 const OPEN_ORDERS_COOLDOWN_MS = 45_000;
+/** Grace before a bracket-trigger `drift_detected` emit. A trigger's close FILL
+ *  arrives on `userFills` and journals the exact close (real price, real PnL,
+ *  reason `bracket_fill`); the drift path's cleanup can only post a generic
+ *  `reconciler_observed_flat`. HL's WS frame ordering between `orderUpdates`
+ *  and `userFills` is undocumented, so without this grace the generic close
+ *  routinely won the race and 50% of HL live closes carried no close reason
+ *  (wisekid, 30d to 2026-08-17: 150/299). The cleanup is idempotent — when the
+ *  fill already journaled + dropped state, the delayed drift is a no-op; when
+ *  the fill never arrives (T-5 gap), the drift still heals, 10s late instead
+ *  of instant (previously ≤5 min via the periodic sweep). */
+const TRIGGER_DRIFT_GRACE_MS = 10_000;
+/** Bound on the oid→cloid map (fills MAY omit `cloid` — facts ledger §3.4 —
+ *  while `orderUpdates` always carries both, so the map backfills the fill's
+ *  client id for bracket recognition). Insertion-ordered eviction. */
+const OID_CLOID_MAP_MAX = 512;
 export class HyperliquidLiveAdapter extends EventEmitter {
     opts;
     api;
@@ -82,6 +98,10 @@ export class HyperliquidLiveAdapter extends EventEmitter {
     /** exchangeTime of the newest fill ingested (WS or backfill) — the overlap
      *  low-water mark the reconnect gap backfill widens from. */
     lastFillIngestMs = 0;
+    /** oid → cloid backfill for fills that omit `cloid` (the journal close path
+     *  recognizes bracket legs by client id). Populated from `orderUpdates`,
+     *  which always carries both. Bounded, insertion-order eviction. */
+    oidToCloid = new Map();
     /** UTC-midnight Day-P&L anchor (KPI-must-equal-the-HL-app, §5.8). HL has no
      *  income endpoint, so the anchor is rebuilt from userFillsByTime + userFunding
      *  each balance fetch. Without this the skill self-computes a bogus anchor and
@@ -821,6 +841,19 @@ export class HyperliquidLiveAdapter extends EventEmitter {
         // healed it, in a repeating flap. Exchange truth is the resync's job.
         if (meta?.isSnapshot)
             return;
+        // Journal close capture: a close-direction fill (bracket SL/TP trigger,
+        // liquidation, external reduce) bypasses close_position, and before this
+        // wiring the journal only learned about it from the reconciler — 50% of
+        // wisekid's 30d closes were `reconciler_observed_flat` heals with the
+        // close reason lost. Route it through the SAME generic path Binance's
+        // ws-ingest uses; `handleReduceOnlyExit` posts the exact close when the
+        // position goes flat and defers to close_position/backstop otherwise.
+        // ONLY close-direction fills are routed: entry/scale-in fills stay with
+        // the synchronous create_order capture, because the WS dedup key
+        // (`openedFromExchangeTradeId === exchangeOrderId`) is unverified against
+        // ccxt's HL order.id shape and a dedup miss would re-mint the 38-duplicate-
+        // pairs class (issue #199 twin bug).
+        this.captureCloseFill(fill);
         try {
             // Matches the primary entry cid OR any additional cid recorded for a
             // scale-in / second resting entry (F5) — matching on `entryCid` alone
@@ -848,27 +881,82 @@ export class HyperliquidLiveAdapter extends EventEmitter {
             logger.error(TAG, `onUserFill handler error: ${formatError(err)}`);
         }
     }
+    /** Close-direction fill → position-decision journal (close-bypass fix, HL
+     *  arm). Fire-and-forget: a journal POST blip must never touch the WS hot
+     *  path. Reduce-only is derived from `dir` (HL fills carry no reduceOnly
+     *  flag): "Close Long"/"Close Short", plus the liquidation marker. Flip
+     *  dirs ("Long > Short") are NOT closes of a tracked side we understand —
+     *  they stay with the reconciler backstop. */
+    captureCloseFill(fill) {
+        const capture = this.opts.autoCapture;
+        if (!capture)
+            return;
+        const dir = (fill.dir ?? '').toLowerCase();
+        const isClose = dir.startsWith('close') || fill.liquidation !== undefined;
+        if (!isClose)
+            return;
+        const price = Number(fill.px);
+        const size = Number(fill.sz);
+        if (!Number.isFinite(price) || price <= 0 || !Number.isFinite(size) || size <= 0)
+            return;
+        const realizedPnl = Number(fill.closedPnl);
+        const cloid = typeof fill.cloid === 'string' && fill.cloid.length > 0
+            ? fill.cloid
+            : this.oidToCloid.get(fill.oid);
+        onWsFillObserved(capture, {
+            symbol: hlCoinToCanonical(fill.coin),
+            side: fill.side === 'B' ? 'buy' : 'sell',
+            exchangeOrderId: String(fill.oid),
+            exchangeTradeId: String(fill.tid),
+            fillPrice: price,
+            fillSize: size,
+            reduceOnly: true,
+            realizedPnl: Number.isFinite(realizedPnl) ? realizedPnl : undefined,
+            clientOrderId: cloid,
+            exchangeTimeMs: Number.isFinite(fill.time) ? fill.time : undefined,
+        }).catch((err) => {
+            logger.warn(TAG, `journal close capture failed for ${fill.coin} oid=${fill.oid}: ${msg(err)}`);
+        });
+    }
     /** `orderUpdates` is authoritative for leg lifecycle (the ALGO_UPDATE
-     *  analog). A trigger = the exchange closed the position — surface the same
+     *  analog). A trigger = the exchange closed the position — surface the
      *  `drift_detected` close shape the Binance reconciler emits so the journal
-     *  close-bypass cleanup fires at once, not ≤5 min late. */
+     *  close-bypass cleanup fires fast — but AFTER a short grace, so the close
+     *  FILL (the exact-close journal path, `captureCloseFill`) wins the
+     *  undocumented orderUpdates/userFills frame ordering. The cleanup is
+     *  idempotent: state already dropped by the fill path ⇒ no-op. */
     onUserOrderUpdate(update) {
         try {
+            // oid→cloid backfill for fills that omit their client id (see
+            // captureCloseFill). orderUpdates always carries both.
+            const { oid, cloid } = update.order;
+            if (typeof oid === 'number' && typeof cloid === 'string' && cloid.length > 0) {
+                this.oidToCloid.set(oid, cloid);
+                if (this.oidToCloid.size > OID_CLOID_MAP_MAX) {
+                    const oldest = this.oidToCloid.keys().next().value;
+                    if (oldest !== undefined)
+                        this.oidToCloid.delete(oldest);
+                }
+            }
             const transition = this.getHlBracketCoordinator().handleOrderUpdate(update);
             if (transition === 'triggered_sl' || transition === 'triggered_tp' || transition === 'forced_close') {
                 const row = this.getHlBracketCoordinator().getLedger().getAll().find((r) => update.order.cloid && (r.slCid === update.order.cloid || r.tpCid === update.order.cloid));
                 const symbol = row?.symbol;
                 if (symbol) {
-                    this.emit('drift_detected', {
-                        timestamp: new Date().toISOString(),
-                        drifts: [
-                            {
-                                type: 'closed',
-                                symbol,
-                                localContracts: row?.qty ?? 0,
-                            },
-                        ],
-                    });
+                    const qty = row?.qty ?? 0;
+                    const timer = setTimeout(() => {
+                        this.emit('drift_detected', {
+                            timestamp: new Date().toISOString(),
+                            drifts: [
+                                {
+                                    type: 'closed',
+                                    symbol,
+                                    localContracts: qty,
+                                },
+                            ],
+                        });
+                    }, TRIGGER_DRIFT_GRACE_MS);
+                    timer.unref?.();
                 }
             }
         }

package/dist/openclaw.js

@@ -74,7 +74,7 @@ export function mergeReefClawConfig(input, connect = {}) {
     // --- tool profile widening ---
     // `openclaw setup` defaults tools.profile to "coding" (2026.6+), whose fixed
     // core allowlist filters out ALL plugin tools — the agent would see none of
-    // the 62 trading tools. tools.alsoAllow explicitly widens the profile;
+    // the 66 trading tools. tools.alsoAllow explicitly widens the profile;
     // group:plugins covers every plugin-provided tool. Union, never replace.
     const existingAlsoAllow = Array.isArray(tools.alsoAllow) ? tools.alsoAllow.map(String) : [];
     if (!existingAlsoAllow.includes('group:plugins')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/connect",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "One-command installer that connects your OpenClaw agent to ReefClaw (paper trading, no exchange keys).",
   "type": "module",
   "bin": {
@@ -15,6 +15,7 @@
   },
   "scripts": {
     "bundle-assets": "node scripts/bundle-assets.mjs",
+    "prepack": "npm run build",
     "build": "tsc && node scripts/bundle-assets.mjs",
     "test": "vitest",
     "test:run": "vitest run"