@reefclaw/connect 0.1.31 → 0.1.33

package/assets/bridge/connector.d.ts

@@ -22,7 +22,9 @@ export declare class Connector {
     private lastMessageAt;
     private destroyed;
     constructor(config: ConnectorConfig, callbacks: ConnectorCallbacks);
-    /** Build the relay WebSocket URL (token is sent via Authorization header, not URL) */
+    /** Build the relay WebSocket URL (token is sent via Authorization header, not
+     *  URL; the instance id is non-secret and rides the query string so the
+     *  relay's skill-slot admission can recognise a same-box restart). */
     private buildUrl;
     /** Start connecting to the relay */
     connect(): void;

package/assets/bridge/connector.js

@@ -37,10 +37,15 @@ export class Connector {
         this.reconnectConfig = { ...DEFAULT_RECONNECT, ...config.reconnect };
         this.heartbeatConfig = { ...DEFAULT_HEARTBEAT };
     }
-    /** Build the relay WebSocket URL (token is sent via Authorization header, not URL) */
+    /** Build the relay WebSocket URL (token is sent via Authorization header, not
+     *  URL; the instance id is non-secret and rides the query string so the
+     *  relay's skill-slot admission can recognise a same-box restart). */
     buildUrl() {
         const base = this.config.relayUrl.replace(/\/$/, '');
-        return `${base}/parties/reefclaw/${this.config.userId}`;
+        const path = `${base}/parties/reefclaw/${this.config.userId}`;
+        return this.config.instanceId
+            ? `${path}?instance=${encodeURIComponent(this.config.instanceId)}`
+            : path;
     }
     /** Start connecting to the relay */
     connect() {
@@ -96,6 +101,24 @@ export class Connector {
                 }, 15 * 60_000);
                 return;
             }
+            // 4011 = another agent holds this account's skill slot and is alive
+            // (relay skill-slot admission, 2026-08-25 — the fix for the 4010
+            // ping-pong two bridges used to fight). Retrying fast is pointless and
+            // noisy: the seated agent keeps the slot until it stops. Slow-probe
+            // every 5 min so a deliberate box switch (stop the old one) is picked
+            // up without a manual restart here.
+            if (code === 4011) {
+                logger.error(TAG, `Relay refused this connection (4011): another agent is already connected for this ` +
+                    `account. ReefClaw runs ONE agent per account — stop the other agent (or revoke its ` +
+                    `token in the dashboard) to move this box in. Probing again in 5 min.`);
+                this.setState('failed');
+                this.attempt = 0;
+                this.reconnectTimer = setTimeout(() => {
+                    this.reconnectTimer = null;
+                    this.connect();
+                }, 5 * 60_000);
+                return;
+            }
             // 4002 = stale skill connection on relay. Wait for it to time out, then retry.
             if (code === 4002) {
                 logger.warn(TAG, 'Stale skill connection on relay — waiting 10s before retry');
@@ -275,6 +298,18 @@ export class Connector {
             // Send a native WebSocket ping (protocol-level, handled by PartyKit automatically).
             if (this.ws && this.ws.readyState === WebSocket.OPEN) {
                 this.ws.ping();
+                // App-level keepalive: native pings are absorbed by the PartyKit
+                // runtime and never reach the relay DO, so an idle-but-healthy agent
+                // would look dead to the skill-slot admission's liveness window and
+                // could be evicted by a second box's probe. One tiny frame per
+                // heartbeat tick keeps the seat provably occupied; the relay swallows
+                // it (never forwarded to browsers, never audited).
+                this.ws.send(JSON.stringify({
+                    type: 'event',
+                    event: 'skill_keepalive',
+                    channel: 'agent_state',
+                    payload: { ts: Date.now() },
+                }));
             }
         }, this.heartbeatConfig.intervalMs);
         logger.debug(TAG, `Heartbeat started: interval=${this.heartbeatConfig.intervalMs}ms timeout=${this.heartbeatConfig.timeoutMs}ms`);

package/assets/bridge/gateway/heartbeat-cron.js

@@ -49,7 +49,8 @@ export const HEARTBEAT_MESSAGE = 'Heartbeat. Execute EVERY checkbox in the HEART
     'do NOT re-read SKILL.md from disk unless preparing a NEW entry). ' +
     'NON-SKIPPABLE every beat: (1) query_trades({hours:1}) stop-watcher reconcile; ' +
     '(2) get_wave9_status() once, unconditionally; ' +
-    '(3) if ANY position is open: get_my_recent_reviews() + get_relevant_learnings({applies_at: heartbeat}) in one batch, ' +
+    '(3) if ANY position is open and the Position Decision Journal is enabled (record_position_reviews reports off-mode when it is not): ' +
+    'get_my_recent_reviews() + get_relevant_learnings({applies_at: heartbeat}) in one batch, ' +
     'then record_position_reviews with ONE review per open position, ' +
     'plus get_resting_liquidity + get_liquidation_levels + get_liquidation_pulse for ALL positions in one parallel batch; ' +
     '(4) the Market Assessment reads. ' +

package/assets/bridge/index.js

@@ -17,6 +17,7 @@ import { GatewayProvider } from './providers/gateway.js';
 import { resolveConfig } from './config.js';
 import { resolveGatewayConfig, validateGatewayConfig } from './gateway/gateway-config.js';
 import { runSetup } from './setup.js';
+import { resolveRelayInstanceId } from './utils/instance-id.js';
 const TAG = 'main';
 // ---- Load .env file (skill/.env only) ----
 function loadEnvFile() {
@@ -223,6 +224,9 @@ async function main() {
         relayUrl,
         userId,
         token,
+        // Stable per-install id → the relay's skill-slot admission recognises a
+        // same-box restart (instant takeover) vs a second box (rejected 4011).
+        instanceId: resolveRelayInstanceId(),
     };
     const bridge = new Bridge(provider, connectorConfig);
     // Handle graceful shutdown

package/assets/bridge/types.d.ts

@@ -602,6 +602,10 @@ export interface ConnectorConfig {
     relayUrl: string;
     userId: string;
     token: string;
+    /** Stable per-install id (non-secret), sent as `?instance=` so the relay's
+     *  skill-slot admission can tell "same box restarting" (instant takeover)
+     *  from "second box" (rejected 4011). See utils/instance-id.ts. */
+    instanceId?: string;
     reconnect?: {
         baseDelayMs?: number;
         maxDelayMs?: number;

package/assets/bridge/utils/instance-id.d.ts

@@ -0,0 +1,3 @@
+/** Read-or-create the stable instance id. `baseDir` overrides the storage
+ *  directory (tests; defaults to ~/.reefclaw). Never throws. */
+export declare function resolveRelayInstanceId(baseDir?: string): string;

package/assets/bridge/utils/instance-id.js

@@ -0,0 +1,48 @@
+// Stable per-install relay instance id (2026-08-25, skill-slot admission).
+//
+// The relay seats ONE skill connection per account and refuses newcomers —
+// EXCEPT a newcomer proving it is the same box restarting, which takes over
+// instantly (the graceful-restart property). "Same box" = this id, sent as a
+// non-secret `?instance=` query param on the relay URL. It must therefore
+// survive process restarts: persisted once per install at
+// `~/.reefclaw/relay-instance-id` and reused forever.
+//
+// Fail-open: when the filesystem refuses (read-only home, exotic container),
+// fall back to a per-process id. Takeover-after-crash then degrades to the
+// relay's liveness timeout instead of being instant — worse, never wrong.
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { logger } from '../logger.js';
+const TAG = 'instance-id';
+const ID_SHAPE = /^[A-Za-z0-9-]{8,64}$/;
+/** Read-or-create the stable instance id. `baseDir` overrides the storage
+ *  directory (tests; defaults to ~/.reefclaw). Never throws. */
+export function resolveRelayInstanceId(baseDir) {
+    // Operator escape hatch (e.g. two deliberate installs sharing one home dir).
+    const fromEnv = process.env.RC_RELAY_INSTANCE_ID?.trim();
+    if (fromEnv && ID_SHAPE.test(fromEnv))
+        return fromEnv;
+    const dir = baseDir ?? join(homedir(), '.reefclaw');
+    const file = join(dir, 'relay-instance-id');
+    try {
+        if (existsSync(file)) {
+            const existing = readFileSync(file, 'utf8').trim();
+            if (ID_SHAPE.test(existing))
+                return existing;
+            // Garbled file: fall through and rewrite — a fresh id only costs one
+            // liveness-timeout takeover, a garbled param corrupts the admission key.
+        }
+        const fresh = randomUUID();
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(file, fresh + '\n', 'utf8');
+        return fresh;
+    }
+    catch (err) {
+        const perProcess = randomUUID();
+        logger.warn(TAG, `Could not persist relay instance id (${err.message}) — using per-process id; ` +
+            `crash takeover degrades to the relay liveness timeout`);
+        return perProcess;
+    }
+}

package/assets/plugin/config/brackets-config.d.ts

@@ -1,6 +1,7 @@
 import { type PluginConfigFile } from './plugin-config-io.js';
 export type BracketMode = 'off' | 'observe' | 'enforce';
-/** Read bracket mode from a config object. Invalid values fall back to 'off'. */
+/** Read bracket mode from a config object. Invalid values fall back to the
+ *  context default ('enforce' on a live-Binance box, else 'off'). */
 export declare function getBracketMode(config?: PluginConfigFile, remoteOverride?: BracketMode): BracketMode;
 /** Convenience: load from disk and return the effective mode. */
 export declare function loadBracketMode(): BracketMode;

package/assets/plugin/config/brackets-config.js

@@ -5,10 +5,32 @@
 //      in memory on the plugin after push; not persisted to plugin-config.json.
 //      Wired in Phase 2; for Phase 1 this is always undefined.
 //   2. Local plugin-config.json `brackets.mode` field.
-//   3. Default: 'off' (legacy stop-watcher remains authoritative).
+//   3. Default: CONTEXT-AWARE since 2026-08-25 (E2E audit #3, the last
+//      real-money item on the fresh-box list): a box whose persisted
+//      tradingMode is MICRO_LIVE/LIVE on the BINANCE venue defaults to
+//      'enforce' — the historical 'off' default meant a fresh npx install
+//      flipped to live traded with NO exchange-side stops AND no mandatory-
+//      stop pre-trade gate (the gate is wired behind bracketsEnabled), i.e.
+//      genuinely naked, with no in-product way to notice. Everything else
+//      (paper, shadow, hyperliquid — whose adapter enforces brackets
+//      unconditionally and ignores this Binance-only knob) keeps 'off'.
+//      An EXPLICIT 'off' in config is still honored (operator break-glass,
+//      behind the Settings type-to-confirm guard) — with the new default it
+//      can only ever be a deliberate choice.
 import { readPluginConfig } from './plugin-config-io.js';
 const VALID = new Set(['off', 'observe', 'enforce']);
-/** Read bracket mode from a config object. Invalid values fall back to 'off'. */
+/** Does this config describe a live-Binance box — the one context where an
+ *  unset bracket mode must NOT mean "no protection"? Reads the PERSISTED
+ *  trading mode (set_trading_mode persists BEFORE the adapter swap, so
+ *  construction-time and per-call reads agree). */
+function isLiveBinanceContext(config) {
+    const mode = config?.tradingMode;
+    if (mode !== 'MICRO_LIVE' && mode !== 'LIVE')
+        return false;
+    return config?.exchange?.venue !== 'hyperliquid';
+}
+/** Read bracket mode from a config object. Invalid values fall back to the
+ *  context default ('enforce' on a live-Binance box, else 'off'). */
 export function getBracketMode(config, remoteOverride) {
     if (remoteOverride && VALID.has(remoteOverride))
         return remoteOverride;
@@ -16,7 +38,7 @@ export function getBracketMode(config, remoteOverride) {
     if (typeof raw === 'string' && VALID.has(raw)) {
         return raw;
     }
-    return 'off';
+    return isLiveBinanceContext(config) ? 'enforce' : 'off';
 }
 /** Convenience: load from disk and return the effective mode. */
 export function loadBracketMode() {

package/assets/plugin/index.js

@@ -1385,12 +1385,21 @@ const paperTradingPlugin = {
                 // Micro-live cap — same loader every runtime reconnect uses
                 // (buildAdapter), so boot and reconnect can never disagree (F8).
                 const microLiveConfig = loadMicroLiveConfig();
-                // Bracket-orders feature flag read from plugin-config at construction time.
-                // Default 'off' keeps legacy stop-watcher behaviour while the feature rolls out.
+                // Bracket-orders feature flag read from plugin-config at construction
+                // time. Since 2026-08-25 (E2E audit #3) the default on a live-Binance
+                // box is 'enforce' — the old 'off' default meant a fresh npx install
+                // flipped to live traded genuinely naked (no exchange stops AND the
+                // mandatory-stop gate skipped, since it is wired behind
+                // bracketsEnabled). An 'off' here can only be an explicit override.
                 const bracketMode = loadBracketMode();
                 if (bracketMode !== 'off') {
                     logger.info(TAG, `Bracket orders enabled in mode=${bracketMode}`);
                 }
+                else {
+                    logger.warn(TAG, `LIVE Binance with brackets.mode='off' (explicit config override) — NO exchange-side ` +
+                        `stops; positions rely on the software watcher alone and the mandatory-stop ` +
+                        `pre-trade gate is OFF. The dashboard readiness banner will show this red.`);
+                }
                 // User-data WebSocket stream flag — same mode-ladder pattern as brackets.
                 // Default 'off' keeps REST polling authoritative. Phase 1 ships dead-code;
                 // the flag flip to 'shadow' / 'observe' / 'enforce' is operator-driven.
@@ -1418,6 +1427,11 @@ const paperTradingPlugin = {
                             // F26: same wiring object as the Binance arm — the SIGTERM
                             // drain covers both venues because it drains this client.
                             tradeIngest,
+                            // Journal close capture (close-bypass fix, HL arm): without
+                            // this, every bracket SL/TP fill leaked as status='open'
+                            // until the reconciler healed it reason-less (50% of wisekid
+                            // 30d closes were reconciler_observed_flat).
+                            autoCapture,
                         },
                     }
                     : {
@@ -2920,6 +2934,14 @@ const paperTradingPlugin = {
             venue,
             publicApi: hlPublicApi ?? binanceApi,
             toolCount: toolNames.length,
+            // live_stop_protection (E2E audit #3): what would stop a losing live
+            // position. Deferred closure over the runtime so paper↔live flips and
+            // adapter swaps surface on the next 5-min report without a restart.
+            resolveStopProtection: () => ({
+                tradingMode: runtime.mode,
+                venueEnforced: runtime.adapter.bracketsAlwaysEnforced === true,
+                bracketMode: loadBracketMode(),
+            }),
         });
         maybeStartConnectorSupervisor();
     },

package/assets/plugin/ingest/position-auto-capture.js

@@ -19,7 +19,7 @@
 // that hooks into the WS-ingest pipeline (see POSITION_DECISION_JOURNAL_PLAN
 // §5.1 for the longer-term design).
 import { logger } from '../logger.js';
-import { isBracketCid } from '../live/bracket-id.js';
+import { isBracketClientId, parseBracketClientId } from '../live/bracket-id.js';
 import { normalizeBracketSymbol } from '../live/bracket-ledger.js';
 import { fillPriceFromOrder } from '../live/fill-price.js';
 import { getSkillVersionCached, withSkillVersion } from './skill-version-reader.js';
@@ -627,7 +627,13 @@ async function handleReduceOnlyExit(ctx, fill) {
     // onClosePositionFilled) or a manual/external close — both are handled by
     // their own paths (close_position's rich reason+assessment, or the reconciler
     // backstop). Closing here would clobber the agent's close reasoning, so defer.
-    const isBracket = fill.clientOrderId ? isBracketCid(fill.clientOrderId) : false;
+    // Recognition is VENUE-DISPATCHED (bracket-id rule): Binance `bkt…`/`rc-…`
+    // cids, Hyperliquid `0xbc7…` cloids — the Binance-only check silently
+    // classed every HL bracket fill as external and deferred it forever.
+    const cidVenue = ctx.venue ?? 'binance';
+    const isBracket = fill.clientOrderId
+        ? isBracketClientId(cidVenue, fill.clientOrderId)
+        : false;
     if (!isBracket) {
         logger.info(TAG, `${fill.symbol} flat via non-bracket reduce-only fill (cid=${fill.clientOrderId ?? 'none'}) — ` +
             `deferring close to close_position / reconciler backstop (no clobber)`);
@@ -643,6 +649,12 @@ async function handleReduceOnlyExit(ctx, fill) {
                 'Auto-journaled from the WS fill — no close_position call (close-bypass path).',
             observedFrom: 'ws_reduce_only_fill',
             clientOrderId: fill.clientOrderId,
+            // Which protective leg fired ('stop' | 'target'), parsed from the cid.
+            // Kept in the assessment (not a new close reason) so the close_reason
+            // vocabulary stays stable for the miner's plan-adherence classifier.
+            leg: fill.clientOrderId
+                ? parseBracketClientId(cidVenue, fill.clientOrderId)?.role
+                : undefined,
         },
         scorecardVerdict: 'NO_GO',
         confluenceScore: 0,

package/assets/plugin/ingest/readiness-reporter.d.ts

@@ -1,4 +1,4 @@
-import { type ReadinessReport, type VenueId, type VenueReachabilityResult } from '@reefclaw/shared';
+import { type ReadinessCheck, type ReadinessReport, type VenueId, type VenueReachabilityResult } from '@reefclaw/shared';
 /** Who froze the loop. 'unknown' when the kernel counter is unreadable (not
  *  Linux / no CONFIG_SCHEDSTATS / first cycle) — attribution is evidence, and
  *  absent evidence stays absent rather than defaulting to a blame. */
@@ -11,6 +11,23 @@ export declare function attributeStall(stallMs: number, runqueueWaitMs: number |
 export interface VenueReachabilityProbe {
     probeReachability(): Promise<VenueReachabilityResult>;
 }
+/** Snapshot for the `live_stop_protection` check (E2E audit #3, 2026-08-25):
+ *  what — if anything — would stop a losing live position. Resolved per cycle
+ *  via a deferred closure over the runtime so it follows paper↔live flips and
+ *  adapter swaps without a restart. */
+export interface StopProtectionSnapshot {
+    /** 'PAPER' | 'SHADOW' | 'MICRO_LIVE' | 'LIVE' (runtime.mode). */
+    tradingMode: string;
+    /** Adapter declares venue-enforced brackets (Hyperliquid live). */
+    venueEnforced: boolean;
+    /** The effective Binance bracket mode ('off' | 'observe' | 'enforce'). */
+    bracketMode: string;
+}
+/** Map a snapshot to the readiness check. Pure — the whole point of the row is
+ *  that `fail` means REAL MONEY WITH NO STOP, so the mapping is unit-tested
+ *  branch by branch. Null snapshot → null (older wiring: omit the row rather
+ *  than fabricate a verdict). */
+export declare function stopProtectionCheck(snap: StopProtectionSnapshot | null, checkedAt: number): ReadinessCheck | null;
 /** Cross-cycle memory for the debounced rungs. Held by the interval loop and
  *  passed in explicitly so `collectReadiness` stays a pure function of its
  *  inputs — a module-global counter would leak between unit tests. */
@@ -31,6 +48,10 @@ export interface ReadinessReporterOptions {
     publicApi: VenueReachabilityProbe;
     /** Number of trading tools registered (a health signal). */
     toolCount: number;
+    /** Resolve the stop-protection snapshot at CALL time (deferred closure over
+     *  the runtime — follows paper↔live flips and adapter swaps). Absent/null →
+     *  the `live_stop_protection` row is omitted, never fabricated. */
+    resolveStopProtection?: () => StopProtectionSnapshot | null;
     fetchImpl?: typeof fetch;
     intervalMs?: number;
     requestTimeoutMs?: number;
@@ -46,7 +67,7 @@ export interface ReadinessReporterOptions {
  *  warn/fail drift is reported 'unknown' (not amber/red) so the readiness
  *  banner doesn't cry-wolf for ~5 min after every restart; a genuinely
  *  skewed clock still surfaces on cycle 2. */
-export declare function collectReadiness(opts: Pick<ReadinessReporterOptions, 'venue' | 'publicApi' | 'toolCount'>, bootWarmup?: boolean, deps?: {
+export declare function collectReadiness(opts: Pick<ReadinessReporterOptions, 'venue' | 'publicApi' | 'toolCount' | 'resolveStopProtection'>, bootWarmup?: boolean, deps?: {
     /** Debounce memory. Omitted → a fresh state, so a lone unreachable reads
      *  `unknown`; only a caller that persists state across cycles can ever
      *  reach the warn rung. */

package/assets/plugin/ingest/readiness-reporter.js

@@ -43,6 +43,45 @@ export function attributeStall(stallMs, runqueueWaitMs) {
     const hostThreshold = Math.max(HOST_WAIT_FLOOR_MS, stallMs * HOST_WAIT_SHARE_OF_STALL);
     return runqueueWaitMs >= hostThreshold ? 'host' : 'self';
 }
+/** Map a snapshot to the readiness check. Pure — the whole point of the row is
+ *  that `fail` means REAL MONEY WITH NO STOP, so the mapping is unit-tested
+ *  branch by branch. Null snapshot → null (older wiring: omit the row rather
+ *  than fabricate a verdict). */
+export function stopProtectionCheck(snap, checkedAt) {
+    if (!snap)
+        return null;
+    const live = snap.tradingMode === 'LIVE' || snap.tradingMode === 'MICRO_LIVE';
+    if (!live) {
+        return makeReadinessCheck('live_stop_protection', 'pass', {
+            detail: 'paper — software stop-watcher',
+            checkedAt,
+        });
+    }
+    if (snap.venueEnforced) {
+        return makeReadinessCheck('live_stop_protection', 'pass', {
+            detail: 'venue-enforced exchange brackets',
+            checkedAt,
+        });
+    }
+    if (snap.bracketMode === 'enforce') {
+        return makeReadinessCheck('live_stop_protection', 'pass', {
+            detail: 'exchange-native brackets (enforce)',
+            checkedAt,
+        });
+    }
+    if (snap.bracketMode === 'observe') {
+        return makeReadinessCheck('live_stop_protection', 'pass', {
+            detail: 'exchange brackets (observe) + software watcher',
+            checkedAt,
+        });
+    }
+    // LIVE with brackets off — with the live-enforce default this can only be an
+    // explicit operator override, and it must burn red on every surface.
+    return makeReadinessCheck('live_stop_protection', 'fail', {
+        detail: `brackets.mode='${snap.bracketMode}' on a ${snap.tradingMode} box`,
+        checkedAt,
+    });
+}
 export function createReadinessCycleState() {
     return { consecutiveReachFailures: 0 };
 }
@@ -84,6 +123,17 @@ export async function collectReadiness(opts, bootWarmup = false, deps = {}) {
         detail: `${opts.toolCount} tools`,
         checkedAt: now,
     }));
+    // live_stop_protection — a local config/adapter read, no network. Resolved
+    // per cycle so a paper→live flip surfaces on the next report without a
+    // restart. Resolver failure → omit the row (absent evidence stays absent).
+    try {
+        const stopCheck = stopProtectionCheck(opts.resolveStopProtection?.() ?? null, now);
+        if (stopCheck)
+            checks.push(stopCheck);
+    }
+    catch (err) {
+        logger.warn(TAG, `stop-protection snapshot failed (row omitted): ${formatError(err)}`);
+    }
     // ★ Probe FIRST, sample the loop delay AFTER. The freeze that makes a probe
     // abort happens *during* the probe, so sampling first would file the evidence
     // in the NEXT cycle's window — reachability would read 'stalled' this cycle
@@ -296,7 +346,12 @@ export function startReadinessReporter(opts) {
     const state = createReadinessCycleState();
     const cycle = async (bootWarmup) => {
         try {
-            const report = await collectReadiness({ venue: opts.venue, publicApi: opts.publicApi, toolCount: opts.toolCount }, bootWarmup, { state });
+            const report = await collectReadiness({
+                venue: opts.venue,
+                publicApi: opts.publicApi,
+                toolCount: opts.toolCount,
+                resolveStopProtection: opts.resolveStopProtection,
+            }, bootWarmup, { state });
             await postReadiness(opts.apiBaseUrl, opts.token, report, fetchImpl, timeoutMs);
             if (report.overall === 'fail') {
                 const failing = report.checks.filter((c) => c.status === 'fail').map((c) => c.id).join(', ');

package/assets/plugin/onboarding/runtime.js

@@ -63,6 +63,10 @@ export function buildAdapter(input) {
                 marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
                 microLive,
                 tradeIngest,
+                // Journal close capture (close-bypass fix) — same wiring the boot
+                // path passes; omitting it here would shed the capture on every
+                // reconnect-built adapter (the F9 class).
+                autoCapture: input.wiring?.autoCapture,
             },
         });
     }

package/assets/plugin/simulator/exchange-simulator.d.ts

@@ -76,7 +76,11 @@ export declare class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice?: number): CcxtOrder;
+    referencePrice?: number, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit?: boolean): CcxtOrder;
     cancelOrder(orderId: string): CcxtOrder;
     cancelAllOrders(symbol?: string): CcxtOrder[];
     /**

package/assets/plugin/simulator/exchange-simulator.js

@@ -290,17 +290,29 @@ export class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice) {
+    referencePrice, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
         // selling positions before the session is cleared and the agent re-reads SKILL.md.
         // Only activates when positions exist (nothing to protect if starting empty).
+        // Protective exits pass through: a stop breached 3s after a restart must
+        // close NOW — blocking the watcher here left positions unprotected for
+        // the whole window (open item since 2026-07-27).
         const elapsed = Date.now() - this.startupTime;
         if (this.hadPositionsAtStartup && elapsed < ExchangeSimulator.STARTUP_LOCKOUT_MS) {
-            const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
-            logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
-            throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            if (protectiveExit) {
+                logger.info(TAG, `Startup lockout bypassed for protective exit: ${side} ${amount} ${symbol}`);
+            }
+            else {
+                const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
+                logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
+                throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            }
         }
         if (amount <= 0) {
             throw new Error('Order amount must be positive');
@@ -410,9 +422,15 @@ export class ExchangeSimulator extends EventEmitter {
         if (closeReason) {
             position.metadata = { ...(position.metadata ?? {}), closeReason };
         }
-        // Create opposing market order to close the position
+        // Create opposing market order to close the position.
+        // Mechanical / operator-initiated exits (stop_watcher, exchange_target,
+        // emergency, operator, bracket_attach_failed, …) must never wait out the
+        // startup lockout — a stop breached seconds after a restart has to close
+        // immediately. Only discretionary closes ('agent' or reason-less) keep
+        // the stale-session guard.
+        const protectiveExit = closeReason !== undefined && closeReason !== 'agent';
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice, protectiveExit);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip

package/assets/plugin/tools/close-position.js

@@ -317,9 +317,18 @@ export async function closePositionTool(args, deps) {
                         'Use get_wave9_status for a reversal authorization or operator_command for an emergency close.');
                 }
             }
+            // Thread the validated reason to the adapter as its CloseReason:
+            // 'operator_command' maps to 'operator' so an operator-driven close is
+            // never caught by the paper startup lockout (whose protective-exit
+            // carve-out keys on the reason — before this, the tool dropped the
+            // reason entirely and EVERY generic close arrived as discretionary).
+            // All other reasons are agent-discretionary by design and stay subject
+            // to the lockout; the rich reason still reaches the journal via
+            // close_reason, this only fixes the adapter-level class + metadata.
+            const adapterCloseReason = args.reason === 'operator_command' ? 'operator' : 'agent';
             return wave9ExitClaimed
                 ? deps.adapter.closePosition(args.symbol, 'wave9_signal_reversal')
-                : deps.adapter.closePosition(args.symbol);
+                : deps.adapter.closePosition(args.symbol, adapterCloseReason);
         };
         const closeWave9 = async () => {
             if (!wave9Lease)

package/assets/plugin/venues/hyperliquid/hl-live-adapter.d.ts

@@ -6,6 +6,7 @@ import { type HlCredentials } from './hl-private.js';
 import type { BracketId } from '../../live/bracket-types.js';
 import { BracketLedger } from '../../live/bracket-ledger.js';
 import { HlBracketCoordinator } from './hl-bracket-coordinator.js';
+import { type AutoCaptureContext } from '../../ingest/position-auto-capture.js';
 import type { TradeIngestWiring } from '../../live/live-adapter.js';
 export interface HlLiveAdapterOptions {
     credentials: HlCredentials;
@@ -23,6 +24,16 @@ export interface HlLiveAdapterOptions {
      *  via userFillsByTime. Same object boot passes the Binance adapter —
      *  `exchange` MUST be fillExchangeId('hyperliquid'). */
     tradeIngest?: TradeIngestWiring;
+    /** Position-decision journal wiring. When present, a close-direction user-
+     *  stream fill (dir "Close …" or a liquidation fill) is routed through
+     *  `onWsFillObserved` so an exchange-native bracket SL/TP fill journals an
+     *  EXACT close (reason `bracket_fill`) instead of leaking as status='open'
+     *  until the reconciler heals it as `reconciler_observed_flat` — the HL
+     *  analog of the wiring Binance's ws-ingest has carried since PR #205.
+     *  Entry/scale-in fills are deliberately NOT routed (the sync create_order
+     *  path captures them; the WS dedup key is unverified on HL — see
+     *  onUserFill). */
+    autoCapture?: AutoCaptureContext;
     /** Test seams. Production omits both. */
     bracketLedger?: BracketLedger;
     disableUserStream?: boolean;
@@ -54,6 +65,10 @@ export declare class HyperliquidLiveAdapter extends EventEmitter implements IExc
     /** exchangeTime of the newest fill ingested (WS or backfill) — the overlap
      *  low-water mark the reconnect gap backfill widens from. */
     private lastFillIngestMs;
+    /** oid → cloid backfill for fills that omit `cloid` (the journal close path
+     *  recognizes bracket legs by client id). Populated from `orderUpdates`,
+     *  which always carries both. Bounded, insertion-order eviction. */
+    private readonly oidToCloid;
     /** UTC-midnight Day-P&L anchor (KPI-must-equal-the-HL-app, §5.8). HL has no
      *  income endpoint, so the anchor is rebuilt from userFillsByTime + userFunding
      *  each balance fetch. Without this the skill self-computes a bogus anchor and
@@ -187,10 +202,20 @@ export declare class HyperliquidLiveAdapter extends EventEmitter implements IExc
      *  `startPosition` is the position BEFORE this fill — the WS-authoritative
      *  way to know the after-fill total without an extra REST read. */
     private onUserFill;
+    /** Close-direction fill → position-decision journal (close-bypass fix, HL
+     *  arm). Fire-and-forget: a journal POST blip must never touch the WS hot
+     *  path. Reduce-only is derived from `dir` (HL fills carry no reduceOnly
+     *  flag): "Close Long"/"Close Short", plus the liquidation marker. Flip
+     *  dirs ("Long > Short") are NOT closes of a tracked side we understand —
+     *  they stay with the reconciler backstop. */
+    private captureCloseFill;
     /** `orderUpdates` is authoritative for leg lifecycle (the ALGO_UPDATE
-     *  analog). A trigger = the exchange closed the position — surface the same
+     *  analog). A trigger = the exchange closed the position — surface the
      *  `drift_detected` close shape the Binance reconciler emits so the journal
-     *  close-bypass cleanup fires at once, not ≤5 min late. */
+     *  close-bypass cleanup fires fast — but AFTER a short grace, so the close
+     *  FILL (the exact-close journal path, `captureCloseFill`) wins the
+     *  undocumented orderUpdates/userFills frame ordering. The cleanup is
+     *  idempotent: state already dropped by the fill path ⇒ no-op. */
     private onUserOrderUpdate;
     /** T-5 REST truth-check — serialized so a slow pass can't stack. */
     private runTruthCheck;

package/assets/plugin/venues/hyperliquid/hl-live-adapter.js

@@ -38,7 +38,8 @@ import { generateBracketId } from '../../live/bracket-id.js';
 import { validateStopDirection, validateTargetDirection } from '../../live/bracket-params.js';
 import { HlBracketCoordinator, isRejectedOrder, isTerminalBracketState, } from './hl-bracket-coordinator.js';
 import { HyperliquidUserStream } from './hl-user-stream.js';
-import { hlFillToFillEvent } from './hl-fill-ingest.js';
+import { hlFillToFillEvent, hlCoinToCanonical } from './hl-fill-ingest.js';
+import { onWsFillObserved } from '../../ingest/position-auto-capture.js';
 import { formatError } from '../../logger.js';
 const TAG = 'hl-live-adapter';
 /** Venue-distinct ledger storage — a venue switch on the same box must never
@@ -55,6 +56,21 @@ const DEFAULT_MARKET_SLIPPAGE = 0.005;
 /** Sticky cooldown after a failed open-orders fetch (the Binance lesson: the
  *  SKILL.md audit→attach loop re-calls every ~3s and would pin the budget). */
 const OPEN_ORDERS_COOLDOWN_MS = 45_000;
+/** Grace before a bracket-trigger `drift_detected` emit. A trigger's close FILL
+ *  arrives on `userFills` and journals the exact close (real price, real PnL,
+ *  reason `bracket_fill`); the drift path's cleanup can only post a generic
+ *  `reconciler_observed_flat`. HL's WS frame ordering between `orderUpdates`
+ *  and `userFills` is undocumented, so without this grace the generic close
+ *  routinely won the race and 50% of HL live closes carried no close reason
+ *  (wisekid, 30d to 2026-08-17: 150/299). The cleanup is idempotent — when the
+ *  fill already journaled + dropped state, the delayed drift is a no-op; when
+ *  the fill never arrives (T-5 gap), the drift still heals, 10s late instead
+ *  of instant (previously ≤5 min via the periodic sweep). */
+const TRIGGER_DRIFT_GRACE_MS = 10_000;
+/** Bound on the oid→cloid map (fills MAY omit `cloid` — facts ledger §3.4 —
+ *  while `orderUpdates` always carries both, so the map backfills the fill's
+ *  client id for bracket recognition). Insertion-ordered eviction. */
+const OID_CLOID_MAP_MAX = 512;
 export class HyperliquidLiveAdapter extends EventEmitter {
     opts;
     api;
@@ -82,6 +98,10 @@ export class HyperliquidLiveAdapter extends EventEmitter {
     /** exchangeTime of the newest fill ingested (WS or backfill) — the overlap
      *  low-water mark the reconnect gap backfill widens from. */
     lastFillIngestMs = 0;
+    /** oid → cloid backfill for fills that omit `cloid` (the journal close path
+     *  recognizes bracket legs by client id). Populated from `orderUpdates`,
+     *  which always carries both. Bounded, insertion-order eviction. */
+    oidToCloid = new Map();
     /** UTC-midnight Day-P&L anchor (KPI-must-equal-the-HL-app, §5.8). HL has no
      *  income endpoint, so the anchor is rebuilt from userFillsByTime + userFunding
      *  each balance fetch. Without this the skill self-computes a bogus anchor and
@@ -821,6 +841,19 @@ export class HyperliquidLiveAdapter extends EventEmitter {
         // healed it, in a repeating flap. Exchange truth is the resync's job.
         if (meta?.isSnapshot)
             return;
+        // Journal close capture: a close-direction fill (bracket SL/TP trigger,
+        // liquidation, external reduce) bypasses close_position, and before this
+        // wiring the journal only learned about it from the reconciler — 50% of
+        // wisekid's 30d closes were `reconciler_observed_flat` heals with the
+        // close reason lost. Route it through the SAME generic path Binance's
+        // ws-ingest uses; `handleReduceOnlyExit` posts the exact close when the
+        // position goes flat and defers to close_position/backstop otherwise.
+        // ONLY close-direction fills are routed: entry/scale-in fills stay with
+        // the synchronous create_order capture, because the WS dedup key
+        // (`openedFromExchangeTradeId === exchangeOrderId`) is unverified against
+        // ccxt's HL order.id shape and a dedup miss would re-mint the 38-duplicate-
+        // pairs class (issue #199 twin bug).
+        this.captureCloseFill(fill);
         try {
             // Matches the primary entry cid OR any additional cid recorded for a
             // scale-in / second resting entry (F5) — matching on `entryCid` alone
@@ -848,27 +881,82 @@ export class HyperliquidLiveAdapter extends EventEmitter {
             logger.error(TAG, `onUserFill handler error: ${formatError(err)}`);
         }
     }
+    /** Close-direction fill → position-decision journal (close-bypass fix, HL
+     *  arm). Fire-and-forget: a journal POST blip must never touch the WS hot
+     *  path. Reduce-only is derived from `dir` (HL fills carry no reduceOnly
+     *  flag): "Close Long"/"Close Short", plus the liquidation marker. Flip
+     *  dirs ("Long > Short") are NOT closes of a tracked side we understand —
+     *  they stay with the reconciler backstop. */
+    captureCloseFill(fill) {
+        const capture = this.opts.autoCapture;
+        if (!capture)
+            return;
+        const dir = (fill.dir ?? '').toLowerCase();
+        const isClose = dir.startsWith('close') || fill.liquidation !== undefined;
+        if (!isClose)
+            return;
+        const price = Number(fill.px);
+        const size = Number(fill.sz);
+        if (!Number.isFinite(price) || price <= 0 || !Number.isFinite(size) || size <= 0)
+            return;
+        const realizedPnl = Number(fill.closedPnl);
+        const cloid = typeof fill.cloid === 'string' && fill.cloid.length > 0
+            ? fill.cloid
+            : this.oidToCloid.get(fill.oid);
+        onWsFillObserved(capture, {
+            symbol: hlCoinToCanonical(fill.coin),
+            side: fill.side === 'B' ? 'buy' : 'sell',
+            exchangeOrderId: String(fill.oid),
+            exchangeTradeId: String(fill.tid),
+            fillPrice: price,
+            fillSize: size,
+            reduceOnly: true,
+            realizedPnl: Number.isFinite(realizedPnl) ? realizedPnl : undefined,
+            clientOrderId: cloid,
+            exchangeTimeMs: Number.isFinite(fill.time) ? fill.time : undefined,
+        }).catch((err) => {
+            logger.warn(TAG, `journal close capture failed for ${fill.coin} oid=${fill.oid}: ${msg(err)}`);
+        });
+    }
     /** `orderUpdates` is authoritative for leg lifecycle (the ALGO_UPDATE
-     *  analog). A trigger = the exchange closed the position — surface the same
+     *  analog). A trigger = the exchange closed the position — surface the
      *  `drift_detected` close shape the Binance reconciler emits so the journal
-     *  close-bypass cleanup fires at once, not ≤5 min late. */
+     *  close-bypass cleanup fires fast — but AFTER a short grace, so the close
+     *  FILL (the exact-close journal path, `captureCloseFill`) wins the
+     *  undocumented orderUpdates/userFills frame ordering. The cleanup is
+     *  idempotent: state already dropped by the fill path ⇒ no-op. */
     onUserOrderUpdate(update) {
         try {
+            // oid→cloid backfill for fills that omit their client id (see
+            // captureCloseFill). orderUpdates always carries both.
+            const { oid, cloid } = update.order;
+            if (typeof oid === 'number' && typeof cloid === 'string' && cloid.length > 0) {
+                this.oidToCloid.set(oid, cloid);
+                if (this.oidToCloid.size > OID_CLOID_MAP_MAX) {
+                    const oldest = this.oidToCloid.keys().next().value;
+                    if (oldest !== undefined)
+                        this.oidToCloid.delete(oldest);
+                }
+            }
             const transition = this.getHlBracketCoordinator().handleOrderUpdate(update);
             if (transition === 'triggered_sl' || transition === 'triggered_tp' || transition === 'forced_close') {
                 const row = this.getHlBracketCoordinator().getLedger().getAll().find((r) => update.order.cloid && (r.slCid === update.order.cloid || r.tpCid === update.order.cloid));
                 const symbol = row?.symbol;
                 if (symbol) {
-                    this.emit('drift_detected', {
-                        timestamp: new Date().toISOString(),
-                        drifts: [
-                            {
-                                type: 'closed',
-                                symbol,
-                                localContracts: row?.qty ?? 0,
-                            },
-                        ],
-                    });
+                    const qty = row?.qty ?? 0;
+                    const timer = setTimeout(() => {
+                        this.emit('drift_detected', {
+                            timestamp: new Date().toISOString(),
+                            drifts: [
+                                {
+                                    type: 'closed',
+                                    symbol,
+                                    localContracts: qty,
+                                },
+                            ],
+                        });
+                    }, TRIGGER_DRIFT_GRACE_MS);
+                    timer.unref?.();
                 }
             }
         }

package/assets/shared/readiness.d.ts

@@ -2,7 +2,7 @@ export type ReadinessStatus = 'pass' | 'warn' | 'fail' | 'unknown';
 /** Which lifecycle phase a check belongs to. `connect` runs with NO Binance API
  *  keys (covers paper trading too); `golive` needs keys (Phase 2). */
 export type ReadinessPhase = 'connect' | 'golive';
-export type ReadinessCheckId = 'binance_reachable' | 'hyperliquid_reachable' | 'clock_in_sync' | 'plugin_loaded' | 'tools_registered' | 'host_responsive';
+export type ReadinessCheckId = 'binance_reachable' | 'hyperliquid_reachable' | 'clock_in_sync' | 'plugin_loaded' | 'tools_registered' | 'host_responsive' | 'live_stop_protection';
 /** What a venue reachability probe concluded.
  *
  *  ★ `stalled` is the one that is NOT about the venue: it means the probe's own

package/assets/shared/readiness.js

@@ -68,6 +68,17 @@ export const READINESS_CHECK_COPY = {
         phase: 'connect',
         fixHint: 'The agent process froze for seconds at a time, so order handling, stop attachment and bracket resync can be delayed by that much. Two things cause this and we could not tell them apart on this host: the host being short of CPU/memory (other containers, agents or a leaking process competing for the box), or something inside the agent process blocking it — note the AI agent itself runs in this same process. Check host load first; if it is idle, the freeze came from inside.',
     },
+    // The safety-floor visibility row (2026-08-25, E2E audit #3): a live box
+    // whose stop protection is not armed used to be indistinguishable from a
+    // healthy one on every dashboard surface. `fail` here means REAL MONEY WITH
+    // NO STOP — the one readiness state that is never acceptable. Emitted with a
+    // detail naming the active protection (exchange brackets / venue-enforced /
+    // paper watcher) so a passing row is informative, not just green.
+    live_stop_protection: {
+        label: 'Live stop protection',
+        phase: 'connect',
+        fixHint: 'This agent is LIVE but exchange-side stop protection is OFF — positions have no stop-loss the exchange would honor if the agent host dies. This only happens when brackets.mode was explicitly set to "off" in the agent\'s plugin-config.json (live boxes default to enforce). Remove that override (or set brackets.mode to "enforce") and restart the agent.',
+    },
 };
 /** Assertive copy for a stall we COULD attribute, passed explicitly as the
  *  `fixHint` override — the same "only name a cause you measured" rule that

package/dist/openclaw.js

@@ -74,7 +74,7 @@ export function mergeReefClawConfig(input, connect = {}) {
     // --- tool profile widening ---
     // `openclaw setup` defaults tools.profile to "coding" (2026.6+), whose fixed
     // core allowlist filters out ALL plugin tools — the agent would see none of
-    // the 62 trading tools. tools.alsoAllow explicitly widens the profile;
+    // the 66 trading tools. tools.alsoAllow explicitly widens the profile;
     // group:plugins covers every plugin-provided tool. Union, never replace.
     const existingAlsoAllow = Array.isArray(tools.alsoAllow) ? tools.alsoAllow.map(String) : [];
     if (!existingAlsoAllow.includes('group:plugins')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/connect",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "One-command installer that connects your OpenClaw agent to ReefClaw (paper trading, no exchange keys).",
   "type": "module",
   "bin": {
@@ -15,6 +15,7 @@
   },
   "scripts": {
     "bundle-assets": "node scripts/bundle-assets.mjs",
+    "prepack": "npm run build",
     "build": "tsc && node scripts/bundle-assets.mjs",
     "test": "vitest",
     "test:run": "vitest run"