@reefclaw/openclaw-plugin 0.1.12 → 0.1.14

package/bridge/providers/gateway.js

@@ -6,12 +6,14 @@ import { join } from 'path';
 import { homedir } from 'os';
 import { logger, formatError } from '../logger.js';
 import { isTradingMode } from '../types.js';
+import { toIntelSymbol } from '@reefclaw/shared';
 import { GatewayHttpClient } from '../gateway/gateway-http-client.js';
 import { GatewayWsClient } from '../gateway/gateway-ws-client.js';
 import { discoverTools } from '../gateway/tool-discovery.js';
 import { EventParser, mapCcxtBalance, mapCcxtOrder, extractLiquidationFields, extractBracketField, extractPlannedLevels, } from '../gateway/event-parser.js';
 import { Poller } from '../gateway/poller.js';
-import { ensureHeartbeatCron } from '../gateway/heartbeat-cron.js';
+import { ensureHeartbeatCron, isHeartbeatLikeName } from '../gateway/heartbeat-cron.js';
+import { parseIdentityName } from '../utils/identity-name.js';
 import { computeEquity as _computeEquity, computePositionNotional as _computePositionNotional, computeRiskMetrics as _computeRiskMetrics, DEFAULT_RISK_LIMITS, } from './risk-calculator.js';
 import { executeKill as _executeKill, executeFlatten as _executeFlatten, executePause as _executePause, executeResume as _executeResume, } from './emergency-commands.js';
 import { executeSetTradingMode, executeGetBracketConfig, executeSetBracketRequirement, executeSetExchangeCredentials, executeTestExchangeCredentials, executeClearExchangeCredentials, } from './onboarding-commands.js';
@@ -130,6 +132,8 @@ function saveSessionStartNav(nav) {
 }
 // ---- Agent state emission interval ----
 const AGENT_STATE_INTERVAL_MS = 5_000;
+/** How often IDENTITY.md is re-read for the agent's display name (local file read). */
+const AGENT_NAME_TTL_MS = 60_000;
 // ---- GatewayProvider ----
 export class GatewayProvider {
     config;
@@ -154,12 +158,21 @@ export class GatewayProvider {
     agentIdentity = {};
     /** Emit the one-time rollout probe (gateway response shape) only on the first attempt. */
     loggedAgentIdentityProbe = false;
+    /** Last IDENTITY.md read (epoch ms) — TTL gate for the display-name re-read. */
+    agentNameReadAtMs = 0;
     /** One-shot latch for the boot-time heartbeat-cron ensure (re-armed on failure). */
     heartbeatCronEnsureStarted = false;
     /** Live heartbeat cadence (seconds), read from the OpenClaw cron store; cached 60s. */
     heartbeatSeconds;
     heartbeatReadAtMs = 0;
     loggedHeartbeat = false;
+    /** Heartbeat-job health read from `cron.list` (RPC — the filesystem jobs.json
+     *  is absent on 2026.7.x). Surfaced so the dashboard shows a failing/stale
+     *  beat instead of a silent gap (a beat failed 10× over ~2 days undetected,
+     *  2026-07-24). undefined until first resolved; refreshed lazily (120s). */
+    heartbeatHealth;
+    heartbeatHealthReadAtMs = 0;
+    heartbeatHealthRefreshing = false;
     lastTicker = null;
     positions = [];
     balance = { currency: 'USDT', total: 0, available: 0, locked: 0 };
@@ -230,6 +243,13 @@ export class GatewayProvider {
     // ---- Trade tracking ----
     /** Timestamp of the most recent trade (fill event) — used in buildAgentState */
     lastTradeTs = null;
+    /** Epoch ms of the most recent LIVE fill observed this process (issue #248).
+     *  Deliberately separate from `lastTradeTs`: that one is a display string and
+     *  is also seeded from the historical trades ledger at startup, which must
+     *  NOT count here — this field exists solely to prove whether the current
+     *  `positions` snapshot predates a fill, and a historical seed would make an
+     *  untorn snapshot look torn forever. 0 = no fill seen yet this process. */
+    lastFillAt = 0;
     /** Tracks open position entries for computing trade results on close.
      *  Key: `symbol:side` (e.g. "BTC/USDT:long"), Value: { entryPrice, quantity, side, entryTime, missionId?, setupType?, regime?, confluenceScore? } */
     openTradeEntries = new Map();
@@ -553,10 +573,11 @@ export class GatewayProvider {
         const ctx = { http: this.http, toolMap: this.toolMap, symbol: this.config.symbol };
         // Pass a FRESH, all-symbols order snapshot so Kill cancels every working
         // order portfolio-wide and correctly identifies (and preserves) protective
-        // reduceOnly brackets. fetchFreshOpenOrders falls back to this.openOrders on
-        // any fetch error, so this never blocks the kill.
-        const freshOrders = await this.fetchFreshOpenOrders();
-        const result = await _executeKill(ctx, freshOrders);
+        // reduceOnly brackets. On a failed fresh read Kill still runs against the
+        // ≤60s cache (never blocked) but reports executed:false — a stale cache
+        // cannot verify coverage (audit 2026-07-26 F6).
+        const freshOrders = await this.fetchFreshOpenOrdersOrNull();
+        const result = await _executeKill(ctx, freshOrders, this.openOrders);
         this.agentMode = 'STOPPED';
         this.emitAgentState();
         return result;
@@ -641,16 +662,23 @@ export class GatewayProvider {
     // Thin wrappers — real logic lives in providers/onboarding-commands.ts
     // so unit tests can drive pure functions with a mocked HTTP client.
     async setTradingMode(mode, acknowledged) {
-        return executeSetTradingMode({ http: this.http, toolMap: this.toolMap }, mode, acknowledged);
+        return executeSetTradingMode(
+        // operatorToken = the rc_* connection token — the plugin refuses the
+        // four state-mutating operator tools without it (audit F12).
+        { http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, mode, acknowledged);
     }
     async setExchangeCredentials(apiKey, secret, testnet) {
-        return executeSetExchangeCredentials({ http: this.http, toolMap: this.toolMap }, apiKey, secret, testnet);
+        return executeSetExchangeCredentials({ http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, apiKey, secret, testnet);
     }
     async testExchangeCredentials(apiKey, secret, testnet) {
         return executeTestExchangeCredentials({ http: this.http, toolMap: this.toolMap }, apiKey, secret, testnet);
     }
     async clearExchangeCredentials() {
-        return executeClearExchangeCredentials({ http: this.http, toolMap: this.toolMap });
+        return executeClearExchangeCredentials({
+            http: this.http,
+            toolMap: this.toolMap,
+            operatorToken: this.config.connectionToken,
+        });
     }
     /** Operator-only. Read the current bracket-orders config from the plugin. */
     async getBracketConfig() {
@@ -658,7 +686,7 @@ export class GatewayProvider {
     }
     /** Operator-only. Flip requireStopLoss or requireTakeProfit. */
     async setBracketRequirement(flag, value) {
-        return executeSetBracketRequirement({ http: this.http, toolMap: this.toolMap }, flag, value);
+        return executeSetBracketRequirement({ http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, flag, value);
     }
     async getSnapshot() {
         logger.info(TAG, 'Reconciliation snapshot requested');
@@ -1152,6 +1180,10 @@ export class GatewayProvider {
                 // Track last trade timestamp for agent state
                 if (data.status === 'FILLED') {
                     this.lastTradeTs = data.timestamp ?? new Date().toISOString();
+                    // A fill debits the paper wallet immediately; `positions` catches up
+                    // on its own poll. Record when, so the RED-zone guard can tell a torn
+                    // wallet/positions snapshot from a real drawdown (issue #248).
+                    this.lastFillAt = Date.now();
                 }
             }
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -1172,6 +1204,28 @@ export class GatewayProvider {
     canonicalSymbol(s) {
         return typeof s === 'string' ? s.replace(/:[A-Z]+$/, '') : s;
     }
+    /** Canonical symbol → the intel DB symbol for this box's venue.
+     *  binance: 'BTC/USDT' → 'BTCUSDT'; hyperliquid: 'BTC/USDC' → 'HL_BTC'.
+     *
+     *  ★ The old venue-blind `.replace('/','')` produced 'BTCUSDC' on a
+     *  hyperliquid box — a symbol no intel row has ever carried (intel
+     *  namespaces every HL row under the 'HL_' prefix). That silently broke the
+     *  regime/signal/mission/analytics pollers AND wrote every trade result to a
+     *  symbol Kelly sizing would never read back, so a hyperliquid box stayed at
+     *  `insufficient_history` even once the reporting path itself worked.
+     *
+     *  FAILS OPEN: an unmappable symbol falls back to the legacy concatenation
+     *  so intel answers "no data for <echo>" — honest and debuggable — rather
+     *  than the caller throwing and dropping the report entirely. */
+    toIntelSymbol(symbol) {
+        const canonical = this.canonicalSymbol(symbol);
+        try {
+            return toIntelSymbol(this.config.venue ?? 'binance', canonical);
+        }
+        catch {
+            return canonical.replace('/', '');
+        }
+    }
     async onPollerPositions(positions) {
         // Canonicalize symbols at this single position-ingress chokepoint so
         // the ENTIRE skill (position-diff, openTradeEntries keys, snapshots,
@@ -1423,6 +1477,10 @@ export class GatewayProvider {
         };
         logger.info(TAG, `Synthetic fill: ${side} ${quantity} ${pos.symbol} @ ${fillPrice} (from position poll)`);
         this.lastTradeTs = now;
+        // Same reasoning as the orderUpdate path (issue #248) — this one is derived
+        // FROM a positions poll, so the snapshot already covers it and the guard
+        // clears on the next refresh rather than latching.
+        this.lastFillAt = Date.now();
         this.fire('orderUpdate', payload);
         // Track open entries for trade result reporting
         const tradeSide = pos.side === 'short' ? 'short' : 'long';
@@ -1710,10 +1768,15 @@ export class GatewayProvider {
             return this.balance;
         }
     }
-    async fetchFreshOpenOrders() {
+    /** Strict fresh read — null on ANY failure (missing tool, thrown fetch,
+     *  non-array garbage). Callers whose verdict claims order-state coverage
+     *  (Kill) MUST distinguish "confirmed list" from "unknown"; collapsing a
+     *  failed read into the ≤60s cache here was how a stale-empty cache became
+     *  a green "No open orders to cancel" (audit 2026-07-26 F6). */
+    async fetchFreshOpenOrdersOrNull() {
         const tool = this.toolMap.fetch_open_orders;
         if (!tool || !this.http)
-            return this.openOrders;
+            return null;
         try {
             // Fetch ALL open orders (no symbol filter). Multi-symbol orphan orders
             // submitted while the browser was disconnected must show up in the
@@ -1722,7 +1785,7 @@ export class GatewayProvider {
             const result = await this.http.invoke(tool, {});
             if (!Array.isArray(result.data)) {
                 logger.warn(TAG, `fetch_open_orders returned non-array: ${typeof result.data}`);
-                return this.openOrders;
+                return null;
             }
             const mapped = result.data
                 .map((o) => mapCcxtOrder(o))
@@ -1734,10 +1797,15 @@ export class GatewayProvider {
             return mapped;
         }
         catch (err) {
-            logger.warn(TAG, `Fresh open orders fetch failed, using cached: ${err instanceof Error ? err.message : String(err)}`);
-            return this.openOrders;
+            logger.warn(TAG, `Fresh open orders fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
         }
     }
+    /** Cached-fallback wrapper for DISPLAY surfaces (the reconcile snapshot):
+     *  stale data beats a blank panel there. Never use for emergency verdicts. */
+    async fetchFreshOpenOrders() {
+        return (await this.fetchFreshOpenOrdersOrNull()) ?? this.openOrders;
+    }
     async fetchAgentHealth() {
         const ws = this.wsClient;
         if (!ws)
@@ -1799,6 +1867,70 @@ export class GatewayProvider {
             this.emitAgentState();
         }
     }
+    /**
+     * Read the heartbeat cron job's health from `cron.list` (RPC — the
+     * filesystem `jobs.json` the cadence reader uses is absent on 2026.7.x).
+     * Extracts `state.consecutiveErrors` + last-run info from the heartbeat-like
+     * job and caches it. Best-effort, fail-open (a version/scope that hides
+     * cron.list simply leaves health undefined → the dashboard shows nothing new,
+     * byte-identical to before). Re-emits agent_state when the value changes so a
+     * newly-failing beat surfaces without waiting for the next tick.
+     *
+     * Why this matters: on 2026-07-24 a customer's beat failed 10× over ~2 days
+     * (bad delivery target, then a heap crash-loop) and NOTHING surfaced it —
+     * `consecutiveErrors` was sitting right here in the cron state the whole time.
+     */
+    async refreshHeartbeatHealth() {
+        const ws = this.wsClient;
+        if (!ws)
+            return;
+        this.heartbeatHealthRefreshing = true;
+        try {
+            const resp = await ws.sendRpc('cron.list', { includeDisabled: true });
+            const jobs = resp?.jobs;
+            if (!Array.isArray(jobs))
+                return; // unknown shape — leave last-known
+            const hb = jobs.find((j) => isHeartbeatLikeName(j?.name));
+            const state = hb?.state;
+            if (!state || typeof state !== 'object')
+                return;
+            const s = state;
+            const next = {
+                consecutiveErrors: typeof s.consecutiveErrors === 'number' && s.consecutiveErrors >= 0 ? s.consecutiveErrors : 0,
+                lastRunAtMs: typeof s.lastRunAtMs === 'number' ? s.lastRunAtMs : undefined,
+                lastRunStatus: typeof s.lastRunStatus === 'string' ? s.lastRunStatus : undefined,
+            };
+            const prev = this.heartbeatHealth;
+            const changed = !prev ||
+                prev.consecutiveErrors !== next.consecutiveErrors ||
+                prev.lastRunAtMs !== next.lastRunAtMs ||
+                prev.lastRunStatus !== next.lastRunStatus;
+            this.heartbeatHealth = next;
+            this.heartbeatHealthReadAtMs = Date.now();
+            if (changed) {
+                if (next.consecutiveErrors > 0) {
+                    logger.warn(TAG, `Heartbeat health: ${next.consecutiveErrors} consecutive error(s), lastStatus=${next.lastRunStatus ?? 'unknown'}`);
+                }
+                this.emitAgentState();
+            }
+        }
+        catch {
+            /* cron.list unavailable (version/scope) — fail open, keep last-known */
+        }
+        finally {
+            this.heartbeatHealthRefreshing = false;
+        }
+    }
+    /** Kick a lazy heartbeat-health refresh when the cache is stale and no
+     *  refresh is in flight. Fire-and-forget: the RPC completion re-emits
+     *  agent_state, so callers stay synchronous. */
+    maybeRefreshHeartbeatHealth() {
+        if (this.heartbeatHealthRefreshing)
+            return;
+        if (Date.now() - this.heartbeatHealthReadAtMs < 120_000)
+            return;
+        void this.refreshHeartbeatHealth();
+    }
     /** Merge newly-resolved identity fields into the cache. Returns true if anything changed. */
     mergeAgentIdentity(found) {
         let changed = false;
@@ -1856,15 +1988,9 @@ export class GatewayProvider {
         ].filter((p) => !!p);
         for (const p of candidates) {
             try {
-                const txt = readFileSync(p, 'utf8');
-                const m = txt.match(/\*\*\s*Name\s*:?\s*\*\*\s*:?\s*(.+)/i);
-                let name = m?.[1]?.trim();
-                if (!name)
-                    continue;
-                name = name.replace(/^[_*`]+|[_*`]+$/g, '').trim(); // strip stray markdown emphasis
-                if (!name || /^\d+$/.test(name) || /\btbd\b|fill this in/i.test(name))
-                    continue;
-                return name;
+                const name = parseIdentityName(readFileSync(p, 'utf8'));
+                if (name)
+                    return name;
             }
             catch {
                 /* not found / unreadable — try the next candidate */
@@ -1872,6 +1998,31 @@ export class GatewayProvider {
         }
         return undefined;
     }
+    /**
+     * Keep the display name fresh WITHOUT waiting for a reconnect.
+     *
+     * Naming the agent is a first-conversation ritual, so IDENTITY.md is usually
+     * written minutes-to-days AFTER the bridge connected. Resolving only on
+     * (re)connect meant the header served the unfilled template for the whole
+     * onboarding session (2026-07-26: rig showed `(pick something you like)` for
+     * ~24h after the agent wrote `Rook`). This is a small local file read, so a
+     * 60s TTL keeps it honest at negligible cost — unlike the model, which needs
+     * an RPC and legitimately only changes across a gateway restart.
+     *
+     * Called from buildAgentState(), so a newly-resolved name rides the payload
+     * being built right now — no extra emit needed.
+     */
+    maybeRefreshAgentName() {
+        const now = Date.now();
+        if (now - this.agentNameReadAtMs < AGENT_NAME_TTL_MS)
+            return;
+        this.agentNameReadAtMs = now;
+        const name = this.resolveAgentNameFromIdentity();
+        // Fail-open: an unreadable/placeholder file keeps the last known good name.
+        if (name && this.mergeAgentIdentity({ name })) {
+            logger.info(TAG, `Agent identity updated: name=${name} (IDENTITY.md re-read)`);
+        }
+    }
     /**
      * Live heartbeat cadence in seconds — the agent's TRUE beat interval, read
      * from the OpenClaw cron store (`~/.openclaw/cron/jobs.json` → the enabled
@@ -1934,6 +2085,11 @@ export class GatewayProvider {
     }
     /** Build agent state from internal fields (used by both emitAgentState and getSnapshot). */
     buildAgentState() {
+        // Lazily keep the heartbeat-failure signal fresh (fire-and-forget, 120s).
+        this.maybeRefreshHeartbeatHealth();
+        // Lazily re-read IDENTITY.md (60s) so a name filled in after connect shows up.
+        this.maybeRefreshAgentName();
+        const hb = this.heartbeatHealth;
         return {
             mode: this.agentMode,
             strategy: this.lastKnownStrategy,
@@ -1948,6 +2104,18 @@ export class GatewayProvider {
                 errorRate: this.eventParser?.getErrorRate() ?? 0,
                 thinkingInterval: this.resolveHeartbeatSeconds() ?? 1800,
                 gatewayWs: this.wsClient?.getState() ?? 'disconnected',
+                // Conditional spread: absent until cron.list resolves the beat's state,
+                // so the payload stays byte-identical to the pre-feature shape when the
+                // gateway/version doesn't expose it.
+                ...(hb
+                    ? {
+                        heartbeatHealth: {
+                            consecutiveErrors: hb.consecutiveErrors,
+                            ...(hb.lastRunAtMs !== undefined ? { lastRunAtMs: hb.lastRunAtMs } : {}),
+                            ...(hb.lastRunStatus !== undefined ? { lastRunStatus: hb.lastRunStatus } : {}),
+                        },
+                    }
+                    : {}),
             },
         };
     }
@@ -1994,12 +2162,34 @@ export class GatewayProvider {
         const IMPOSSIBLE_DRAWDOWN = -0.5;
         const REQUIRED_RED_STREAK = 3;
         const MIN_RED_PERSISTENCE_MS = 25_000;
+        /** Ceiling on the issue #248 torn-snapshot deferral — see below. */
+        const MAX_TORN_SNAPSHOT_DEFER_MS = 5 * 60_000;
         if (metrics.drawdownZone === 'RED' && this.agentMode === 'ACTIVE') {
             if (this.redZoneStreak === 0)
                 this.redZoneSince = Date.now();
             this.redZoneStreak++;
             const redForMs = Date.now() - this.redZoneSince;
             const survivedPositionsRefresh = this.positionsUpdatedAt > this.redZoneSince;
+            // ★ issue #248: `survivedPositionsRefresh` proves a refresh HAPPENED, not
+            // that it INCORPORATED the fill that debited the wallet. When a fill has
+            // landed since the last positions refresh the snapshot is torn BY
+            // DEFINITION — paper deducts full notional at open, so equity is
+            // understated by exactly that notional and any entry >2.5% of NAV reads
+            // as RED. Measured on a live box: entries of 8.25% / 8.11% of NAV
+            // produced -8.09% / -7.93% verdicts 4s after each fill, on an account
+            // that was UP on the day. This condition can only ever WIDEN deferral —
+            // it never licenses a flatten the old code would have refused.
+            const positionsCoverLatestFill = this.lastFillAt === 0 || this.positionsUpdatedAt > this.lastFillAt;
+            // ...but BOUND that deferral. The tear resolves within one positions poll
+            // (~10s), so a RED verdict still standing after MAX_TORN_SNAPSHOT_DEFER_MS
+            // is not a snapshot artifact and must be honoured. Without a ceiling, a
+            // flapping synthetic-fill detector would keep `lastFillAt` ahead of every
+            // refresh and disarm the auto-flatten INDEFINITELY — and that detector is
+            // known to fabricate (it invented a duplicate fill 8s after a real one on
+            // 2026-07-25). Disarming a safety control on the word of an unreliable
+            // component is the worse failure direction, so the tear only ever BUYS
+            // TIME; past the ceiling the ordinary #213 debounce governs again.
+            const tornSnapshotBlocks = !positionsCoverLatestFill && redForMs < MAX_TORN_SNAPSHOT_DEFER_MS;
             if (uptimeMs < STARTUP_GRACE_PERIOD_MS) {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) but within startup grace period (${Math.round(uptimeMs / 1000)}s) — skipping auto-flatten`);
             }
@@ -2011,8 +2201,9 @@ export class GatewayProvider {
             }
             else if (this.redZoneStreak < REQUIRED_RED_STREAK ||
                 redForMs < MIN_RED_PERSISTENCE_MS ||
-                !survivedPositionsRefresh) {
-                logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — deferring auto-flatten until the verdict persists (streak ${this.redZoneStreak}/${REQUIRED_RED_STREAK}, ${Math.round(redForMs / 1000)}s/${MIN_RED_PERSISTENCE_MS / 1000}s, survivedPositionsRefresh=${survivedPositionsRefresh}). A fresh entry's notional reads as phantom drawdown until the position snapshot catches up (issue #213); a real drawdown will persist and flatten on a later evaluation.`);
+                !survivedPositionsRefresh ||
+                tornSnapshotBlocks) {
+                logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — deferring auto-flatten until the verdict persists (streak ${this.redZoneStreak}/${REQUIRED_RED_STREAK}, ${Math.round(redForMs / 1000)}s/${MIN_RED_PERSISTENCE_MS / 1000}s, survivedPositionsRefresh=${survivedPositionsRefresh}, positionsCoverLatestFill=${positionsCoverLatestFill}, tornSnapshotBlocks=${tornSnapshotBlocks}). A fresh entry's notional reads as phantom drawdown until the position snapshot catches up (issues #213/#248); a real drawdown will persist and flatten on a later evaluation.`);
             }
             else {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — auto-flattening all positions`);
@@ -2159,7 +2350,13 @@ export class GatewayProvider {
         const url = this.config.intelligenceUrl;
         const token = this.config.connectionToken;
         if (!url || !token) {
-            logger.debug(TAG, 'Intelligence not configured — skipping trade result report');
+            // NEVER debug-level. This is the only writer of intel's `trade_results`,
+            // and those rows are what `minTradesForKelly` counts and what
+            // `get_agent_profile` derives its tier from. Silently skipping here is
+            // indistinguishable from "the agent has never traded" — which is exactly
+            // how it read for months. See DEFAULT_INTELLIGENCE_URL in gateway-config.
+            logger.warn(TAG, `Intelligence not configured (url=${url ? 'set' : 'MISSING'}, token=${token ? 'set' : 'MISSING'}) — DROPPING trade result for ${symbol}. `
+                + 'Kelly sizing and the agent profile are computed from these rows and will stay pinned at their no-history defaults.');
             return;
         }
         const direction = entry.side === 'long' ? 'LONG' : 'SHORT';
@@ -2171,7 +2368,7 @@ export class GatewayProvider {
         const durationSeconds = Math.floor((Date.now() - new Date(entry.entryTime).getTime()) / 1000);
         const tradeResult = {
             missionId: entry.missionId ?? `trade-${Date.now()}`,
-            symbol: symbol.replace('/', ''), // BTC/USDT → BTCUSDT for Intelligence API
+            symbol: this.toIntelSymbol(symbol), // venue-aware: BTC/USDT → BTCUSDT, BTC/USDC → HL_BTC
             direction,
             strategy: this.lastKnownStrategy.name,
             regime: entry.regime ?? this.currentRegime,
@@ -2256,9 +2453,9 @@ export class GatewayProvider {
         }
     }
     // ---- Intelligence service polling ----
-    /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */
+    /** The configured symbol as the intel DB spells it. */
     get intelligenceSymbol() {
-        return this.config.symbol.replace('/', '');
+        return this.toIntelSymbol(this.config.symbol);
     }
     /** Shared intelligence poller with circuit-breaker (exponential backoff on errors). */
     startIntelligencePoller(name, endpoint, intervalMs, onData, intervalRef, delayFirstMs = 0) {
@@ -2270,6 +2467,21 @@ export class GatewayProvider {
             }
             return;
         }
+        // These five read-pollers (regime 60s, signals 10s, missions 10s,
+        // analytics 30s, decision-trace 30s ≈ 22 req/min per box) were dormant for
+        // as long as `intelligenceUrl` had no default. Giving it one turns them on
+        // everywhere, which is the intended behaviour — they feed the dashboard's
+        // regime/signals/missions panels — but it IS new load on an intel API with
+        // a known heap leak. Kill-switch so that load can be shed in one restart
+        // WITHOUT taking the trade_results writer down with it: the writer is what
+        // Kelly sizing and the agent tier are computed from, and it does not go
+        // through this function.
+        if (process.env.RC_SKILL_INTEL_POLL === 'off') {
+            if (name === 'regime') {
+                logger.warn(TAG, 'RC_SKILL_INTEL_POLL=off — intelligence read-polling disabled (trade-result reporting is unaffected)');
+            }
+            return;
+        }
         const symbol = this.intelligenceSymbol;
         const fullUrl = `${url}/api/${endpoint}/${symbol}`;
         logger.info(TAG, `Starting ${name} poller: ${fullUrl}`);

package/bridge/providers/onboarding-commands.d.ts

@@ -38,6 +38,14 @@ export interface ClearExchangeCredentialsOutcome {
 export interface OnboardingContext {
     http: GatewayHttpClient | null;
     toolMap: ToolMap;
+    /** rc_* connection token, injected as `operator_token` on the four
+     *  state-MUTATING operator tools (set_trading_mode /
+     *  set_exchange_credentials / clear_exchange_credentials /
+     *  set_bracket_requirement). The plugin refuses those calls without it
+     *  (audit 2026-07-26 F12) — this is the operator-provenance proof that the
+     *  request came through the dashboard path, which the agent cannot forge
+     *  conversationally (chat redaction strips rc_* tokens). */
+    operatorToken?: string;
 }
 export type BracketMode = 'off' | 'observe' | 'enforce';
 export type BracketRequirementFlag = 'requireStopLoss' | 'requireTakeProfit';

package/bridge/providers/onboarding-commands.js

@@ -23,7 +23,7 @@ export async function executeSetTradingMode(ctx, mode, acknowledged) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { mode, acknowledged });
+        const result = await ctx.http.invoke(tool, { mode, acknowledged, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -93,7 +93,7 @@ export async function executeClearExchangeCredentials(ctx) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { confirm: true });
+        const result = await ctx.http.invoke(tool, { confirm: true, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -162,7 +162,7 @@ export async function executeSetBracketRequirement(ctx, flag, value) {
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { flag, value });
+        const result = await ctx.http.invoke(tool, { flag, value, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {
@@ -194,7 +194,7 @@ export async function executeSetExchangeCredentials(ctx, apiKey, secret, testnet
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet });
+        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {

package/bridge/types.d.ts

@@ -54,6 +54,25 @@ export interface OrderData {
      * paper / legacy paths (treated as a working order → cancellable).
      */
     protective?: boolean;
+    /** Limit price. Undefined for market and trigger-only orders. */
+    price?: number;
+    /**
+     * Trigger price for a stop / take-profit order — Binance `stopPrice`,
+     * Hyperliquid `triggerPx`.
+     *
+     * ★ Without this the dashboard cannot see a resting protective leg AT ALL:
+     * `type` is collapsed to MARKET|LIMIT here, so a STOP_MARKET is
+     * indistinguishable from a market order on the wire. That is what left an HL
+     * micro-live book — every position bracketed on the exchange — drawing an
+     * entry line and nothing else, under a false "NO STOP" alarm.
+     */
+    stopPrice?: number;
+    /**
+     * Which protective leg this order IS, normalised at the venue boundary so no
+     * consumer has to parse venue type strings ('STOP_MARKET' on Binance,
+     * 'Stop Market' on Hyperliquid). Undefined for working entry orders.
+     */
+    protectiveRole?: 'stop' | 'target';
 }
 export interface FillData {
     id: string;
@@ -103,6 +122,17 @@ export interface AgentStateData {
             thinkingInterval: number;
             /** Gateway WebSocket state — helps diagnose chat delivery failures */
             gatewayWs?: string;
+            /** Heartbeat-cron health from `cron.list`. Absent on gateway versions
+             *  that don't expose cron state (byte-identical to pre-feature). Lets the
+             *  dashboard surface a failing/stale beat instead of a silent gap. */
+            heartbeatHealth?: {
+                /** Consecutive failed runs; >0 means the beat isn't delivering. */
+                consecutiveErrors: number;
+                /** Epoch ms of the last run start (any outcome). */
+                lastRunAtMs?: number;
+                /** Last run outcome, e.g. "ok" | "error". */
+                lastRunStatus?: string;
+            };
         };
     };
     timestamp: string;

package/bridge/utils/identity-name.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Parse the agent's display name out of an OpenClaw workspace `IDENTITY.md`.
+ *
+ * Extracted from GatewayProvider so the placeholder rules are unit-testable
+ * against the real template text — a placeholder that slips through is shown
+ * to the user AS the agent's name, which is exactly the bug this guards
+ * (2026-07-26: a dashboard header read `(pick something you like)` while the
+ * file said `Rook`). See docs/CLAUDE/agent-runtime.md §6.
+ */
+/**
+ * Extract `- **Name:** <X>` from IDENTITY.md markdown.
+ *
+ * Returns `undefined` when the file has no name, the value is an unfilled
+ * template placeholder, or it looks like an id rather than a name — callers
+ * fail open to their own UI placeholder.
+ *
+ * The value may sit on the line BELOW the label (the template's own layout):
+ *
+ *     - **Name:**
+ *       Rook
+ *
+ * which the `\s*` between `**` and the capture spans.
+ */
+export declare function parseIdentityName(markdown: string): string | undefined;

package/bridge/utils/identity-name.js

@@ -0,0 +1,54 @@
+/**
+ * Parse the agent's display name out of an OpenClaw workspace `IDENTITY.md`.
+ *
+ * Extracted from GatewayProvider so the placeholder rules are unit-testable
+ * against the real template text — a placeholder that slips through is shown
+ * to the user AS the agent's name, which is exactly the bug this guards
+ * (2026-07-26: a dashboard header read `(pick something you like)` while the
+ * file said `Rook`). See docs/CLAUDE/agent-runtime.md §6.
+ */
+/**
+ * Values the template ships (or a half-filled file leaves behind) that must
+ * never reach the UI. Matched AFTER markdown emphasis is stripped.
+ */
+const PLACEHOLDER_PATTERNS = [
+    /\btbd\b/i,
+    /fill this in/i,
+    // OpenClaw's own template values are parenthesised prompts, e.g.
+    //   _(pick something you like)_
+    //   _(AI? robot? familiar? ghost in the machine? something weirder?)_
+    //   _(your signature — pick one that feels right)_
+    // Any value that is ENTIRELY a bracketed aside is a prompt, not a name.
+    /^\(.*\)$/s,
+    /^\[.*\]$/s,
+    /^<.*>$/s,
+];
+/**
+ * Extract `- **Name:** <X>` from IDENTITY.md markdown.
+ *
+ * Returns `undefined` when the file has no name, the value is an unfilled
+ * template placeholder, or it looks like an id rather than a name — callers
+ * fail open to their own UI placeholder.
+ *
+ * The value may sit on the line BELOW the label (the template's own layout):
+ *
+ *     - **Name:**
+ *       Rook
+ *
+ * which the `\s*` between `**` and the capture spans.
+ */
+export function parseIdentityName(markdown) {
+    const m = markdown.match(/\*\*\s*Name\s*:?\s*\*\*\s*:?\s*(.+)/i);
+    let name = m?.[1]?.trim();
+    if (!name)
+        return undefined;
+    // Strip stray markdown emphasis (the template wraps placeholders in `_`).
+    name = name.replace(/^[_*`]+|[_*`]+$/g, '').trim();
+    if (!name)
+        return undefined;
+    if (/^\d+$/.test(name))
+        return undefined; // an id, not a name
+    if (PLACEHOLDER_PATTERNS.some((re) => re.test(name)))
+        return undefined;
+    return name;
+}