@reefclaw/openclaw-plugin 0.1.12 → 0.1.14

package/live/proposal-decision-listener.js

@@ -3,29 +3,31 @@
 //
 // Phase B implementation: polls GET /api/internal/proposed_orders/pending-decisions
 // at config.pollIntervalMs (default 3 sec). For each approved-but-unfired row:
-//   1. Drift abandon — if mark price has moved more than ±0.3 R from the
+//   1. POST /claim — atomically acquire non-transferable DB ownership before
+//      any exchange side effect. A second listener cannot acquire the row.
+//   2. Drift abandon — if mark price has moved more than ±0.3 R from the
 //      proposed entry since the proposal was created, fail with a transparent
 //      `fireError` rather than firing into a different setup.
-//   2. Fire via createOrderTool — same backend function the toggle-off path
-//      calls directly. Reuses the pre-trade risk gate, bracket attach, and
-//      auto-capture entry-row write.
-//   3. PATCH /fire-result with either firedOrderId or fireError. Fired-once
-//      idempotency lives in the DB constraint (status='approved' AND
-//      fired_order_id IS NULL filter).
+//   3. Fire via createOrderTool with a proposal-derived exchange CID — same
+//      backend function the toggle-off path calls directly. Once this boundary
+//      starts, only result persistence may retry.
+//   4. PATCH /fire-result with the claim token and either firedOrderId or
+//      fireError. An exact lost-response retry is idempotently acknowledged.
 //
 // Started by index.ts only when config.approval.mode === 'per_trade' AND
 // ingest credentials are present. Drained at shutdown so an in-flight fire
-// completes its PATCH before the process exits.
+// gets one final opportunity to complete its PATCH before the process exits.
 //
 // Why polling and not relay events: simpler — no skill <-> plugin event-bus
 // changes needed. 3-sec poll is well under the latency a human approval flow
 // tolerates. Refactor to SSE/relay-push only if measurement shows the poll
-// load is meaningful (very unlikely — ~3 req/s per user is negligible).
+// load is meaningful (very unlikely — ~0.33 req/s per active user is small).
 //
 // See docs/APPROVAL_MODE_DESIGN.md §2 (architecture) + §7.3 (re-validation) +
 // §10 failure matrix.
+import { randomUUID } from 'node:crypto';
 import { logger, formatError } from '../logger.js';
-import { createOrderTool } from '../tools/create-order.js';
+import { createOrderTool, proposalEntryClientOrderId, } from '../tools/create-order.js';
 const TAG = 'proposal-decision-listener';
 export class ProposalDecisionListener {
     opts;
@@ -40,6 +42,9 @@ export class ProposalDecisionListener {
         running: false,
         ticksTotal: 0,
         ticksWithFires: 0,
+        claimsAcquired: 0,
+        claimConflicts: 0,
+        claimFailures: 0,
         firesAttempted: 0,
         firesSucceeded: 0,
         firesAbandonedDrift: 0,
@@ -48,6 +53,21 @@ export class ProposalDecisionListener {
         pollFailures: 0,
         lastTickAt: null,
     };
+    /** Claim tokens are process-local by design. A new process must never steal
+     *  an old process's durable claim, because it cannot know whether the
+     *  exchange accepted an order just before the crash. */
+    claimTokens = new Map();
+    /** In-memory work queue for claims whose POST or fire-result response was
+     *  lost. The DB poll excludes claimed rows, so only the original process can
+     *  retry its exact token/outcome; a restarted process cannot steal it. */
+    claimedCandidates = new Map();
+    acquiredClaims = new Set();
+    /** Once present, this process must never invoke createOrderTool for the
+     *  proposal again. Any subsequent work is result persistence only. */
+    mutationsStarted = new Set();
+    /** Completed outcomes awaiting a successful fire-result response. Retrying
+     *  this PATCH is safe; retrying the exchange mutation is not. */
+    pendingResults = new Map();
     constructor(options) {
         this.opts = {
             baseUrl: options.baseUrl.replace(/\/+$/, ''),
@@ -119,7 +139,14 @@ export class ProposalDecisionListener {
     async tick() {
         this.health.ticksTotal++;
         this.health.lastTickAt = new Date().toISOString();
-        const pending = await this.fetchPending();
+        const fetched = await this.fetchPending();
+        // Claimed rows disappear from the DB poll. Keep only this process's exact
+        // token/candidate in a private queue so lost claim and result responses
+        // can be retried without making claims stealable after restart.
+        const pendingById = new Map(this.claimedCandidates);
+        for (const proposal of fetched)
+            pendingById.set(proposal.id, proposal);
+        const pending = [...pendingById.values()];
         if (pending.length === 0) {
             // Idle backoff — schedule next tick at the longer idle interval until
             // the queue becomes non-empty. This is the dominant cost-reduction lever
@@ -137,12 +164,10 @@ export class ProposalDecisionListener {
                 await this.firePending(p);
             }
             catch (err) {
-                // Defensive — firePending should already write a fireError PATCH on
-                // any failure path. If something escapes, surface it loudly so the
-                // operator can diagnose; the proposal will remain in approved state
-                // and be retried on the next tick (idempotent because firedOrderId
-                // is still NULL until a successful PATCH writes it).
-                logger.error(TAG, `Unhandled exception firing proposal ${p.id} (will retry next tick): ${formatError(err)}`);
+                // Before the mutation latch, the original token/candidate may retry.
+                // After the latch, firePending refuses another exchange call and the
+                // durable claim/CID require manual reconciliation if no result exists.
+                logger.error(TAG, `Unhandled exception processing claimed proposal ${p.id}: ${formatError(err)}`);
             }
         }
     }
@@ -158,6 +183,7 @@ export class ProposalDecisionListener {
                     headers: {
                         authorization: `Bearer ${this.opts.ingestToken}`,
                         'x-user-id': this.opts.userId,
+                        'x-reefclaw-proposal-claim-version': '1',
                     },
                     signal: ac.signal,
                 });
@@ -179,8 +205,97 @@ export class ProposalDecisionListener {
             return [];
         }
     }
+    async claimPending(proposalId, claimToken) {
+        const url = `${this.opts.baseUrl}/api/internal/proposed_orders/${proposalId}/claim`;
+        try {
+            const ac = new AbortController();
+            const tid = setTimeout(() => ac.abort(), this.opts.requestTimeoutMs);
+            let res;
+            try {
+                res = await this.opts.fetchImpl(url, {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        authorization: `Bearer ${this.opts.ingestToken}`,
+                        'x-user-id': this.opts.userId,
+                    },
+                    body: JSON.stringify({ claimToken }),
+                    signal: ac.signal,
+                });
+            }
+            finally {
+                clearTimeout(tid);
+            }
+            if (res.status === 409) {
+                this.health.claimConflicts++;
+                logger.info(TAG, `Proposal ${proposalId} was claimed by another listener`);
+                return 'conflict';
+            }
+            if (!res.ok) {
+                this.health.claimFailures++;
+                logger.warn(TAG, `POST ${url} returned ${res.status}`);
+                return 'unknown';
+            }
+            const body = await res.json();
+            if (body.ok !== true
+                || body.id !== proposalId
+                || body.claimToken !== claimToken) {
+                this.health.claimFailures++;
+                logger.warn(TAG, `POST ${url} returned a malformed claim acknowledgement`);
+                return 'unknown';
+            }
+            return 'acquired';
+        }
+        catch (err) {
+            this.health.claimFailures++;
+            logger.warn(TAG, `POST ${url} threw: ${formatError(err)}`);
+            return 'unknown';
+        }
+    }
+    forgetClaim(proposalId) {
+        this.claimTokens.delete(proposalId);
+        this.claimedCandidates.delete(proposalId);
+        this.acquiredClaims.delete(proposalId);
+        this.mutationsStarted.delete(proposalId);
+        this.pendingResults.delete(proposalId);
+    }
     async firePending(p) {
+        let claimToken = this.claimTokens.get(p.id);
+        if (!claimToken) {
+            claimToken = randomUUID();
+            this.claimTokens.set(p.id, claimToken);
+            this.claimedCandidates.set(p.id, p);
+        }
+        if (!this.acquiredClaims.has(p.id)) {
+            const claimStatus = await this.claimPending(p.id, claimToken);
+            if (claimStatus !== 'acquired') {
+                if (claimStatus === 'conflict')
+                    this.forgetClaim(p.id);
+                return;
+            }
+            this.acquiredClaims.add(p.id);
+            this.health.claimsAcquired++;
+        }
+        const awaitingPersistence = this.pendingResults.get(p.id);
+        if (awaitingPersistence) {
+            if (await this.patchResult(p.id, awaitingPersistence)
+                && awaitingPersistence.firedOrderId) {
+                this.health.firesSucceeded++;
+            }
+            return;
+        }
+        if (this.mutationsStarted.has(p.id)) {
+            logger.error(TAG, `Proposal ${p.id} has an ambiguous claimed mutation; refusing automatic re-fire`);
+            return;
+        }
         this.health.firesAttempted++;
+        if (Date.now() >= new Date(p.hardExpiresAt).getTime()) {
+            await this.patchResult(p.id, {
+                fireError: `hard_expired before fire (expired ${p.hardExpiresAt})`,
+            });
+            this.health.firesFailedTrading++;
+            return;
+        }
         // ---- 1. Drift abandon (Locked Decision #6) ----
         // Skip if we can't read a current price — better to let the trading path
         // surface the error than to silently abandon on a transient ticker miss.
@@ -198,35 +313,60 @@ export class ProposalDecisionListener {
                 }
             }
         }
+        // Validation can cross the hard-expiry boundary. Claim ownership alone is
+        // not authorization to submit after the deadline.
+        if (Date.now() >= new Date(p.hardExpiresAt).getTime()) {
+            await this.patchResult(p.id, {
+                fireError: `hard_expired before exchange mutation (expired ${p.hardExpiresAt})`,
+            });
+            this.health.firesFailedTrading++;
+            return;
+        }
         // ---- 2. Fire via createOrderTool (same path toggle-off mode uses) ----
         // CRITICAL: do NOT pass proposalManager + userId here. The listener IS the
         // consumer of approved proposals; passing proposalManager would recursively
         // dual-write another proposal row for the same intent. The agent's path
         // dual-writes; the listener's path fires the underlying order.
-        const result = await createOrderTool({
-            symbol: p.symbol,
-            side: p.side,
-            type: p.orderType,
-            amount: p.size,
-            // For limit orders we honour the original proposed entry. For market,
-            // the create_order tool reads the live ticker (per existing semantics).
-            price: p.orderType === 'limit' ? p.proposedEntry : undefined,
-            stopPrice: p.stopPrice,
-            target_price: p.targetPrice,
-            setup_type: p.setupType,
-            thesis: p.thesis,
-            regime: p.regime,
-            regime_confidence: p.regimeConfidence,
-            scorecard_verdict: p.scorecardVerdict,
-            confluence_score: p.confluenceScore,
-        }, {
-            binanceApi: this.opts.binanceApi,
-            adapter: this.opts.adapter,
-            autoCapture: this.opts.autoCapture,
-            operationLock: this.opts.operationLock,
-            checkWave9LiveSymbolOwnership: this.opts.checkWave9LiveSymbolOwnership,
-            // proposalManager + userId deliberately omitted — see above.
-        });
+        const entryClientOrderId = proposalEntryClientOrderId(this.opts.adapter, p.proposalUuid);
+        // This latch is set immediately before the function that can touch the
+        // exchange. No path clears it until fire-result is durably acknowledged.
+        this.mutationsStarted.add(p.id);
+        let result;
+        try {
+            result = await createOrderTool({
+                symbol: p.symbol,
+                side: p.side,
+                type: p.orderType,
+                amount: p.size,
+                // For limit orders we honour the original proposed entry. For market,
+                // the create_order tool reads the live ticker (per existing semantics).
+                price: p.orderType === 'limit' ? p.proposedEntry : undefined,
+                stopPrice: p.stopPrice,
+                target_price: p.targetPrice,
+                setup_type: p.setupType,
+                thesis: p.thesis,
+                regime: p.regime,
+                regime_confidence: p.regimeConfidence,
+                scorecard_verdict: p.scorecardVerdict,
+                confluence_score: p.confluenceScore,
+            }, {
+                binanceApi: this.opts.binanceApi,
+                adapter: this.opts.adapter,
+                autoCapture: this.opts.autoCapture,
+                operationLock: this.opts.operationLock,
+                checkWave9LiveSymbolOwnership: this.opts.checkWave9LiveSymbolOwnership,
+                entryClientOrderId,
+                // proposalManager + userId deliberately omitted — see above.
+            });
+        }
+        catch (err) {
+            await this.patchResult(p.id, {
+                fireError: `order_outcome_ambiguous: create_order threw after mutation boundary ` +
+                    `(clientOrderId=${entryClientOrderId}): ${formatError(err)}`,
+            });
+            this.health.firesFailedTrading++;
+            return;
+        }
         if ('error' in result) {
             // Trading-path rejection (risk gate, bracket attach failure, exchange
             // rejection, etc.). Surface to the operator via the proposal row.
@@ -246,12 +386,30 @@ export class ProposalDecisionListener {
             this.health.firesFailedTrading++;
             return;
         }
-        const firedOrderId = typeof result.id === 'string' ? result.id : `unknown-${Date.now()}`;
+        if (typeof result.id !== 'string' || result.id.length === 0) {
+            await this.patchResult(p.id, {
+                fireError: `order_outcome_ambiguous: exchange acknowledgement had no order id ` +
+                    `(clientOrderId=${entryClientOrderId})`,
+            });
+            this.health.firesFailedTrading++;
+            return;
+        }
+        const firedOrderId = result.id;
         logger.info(TAG, `Proposal ${p.id} fired → order ${firedOrderId}`);
-        await this.patchResult(p.id, { firedOrderId });
-        this.health.firesSucceeded++;
+        if (await this.patchResult(p.id, { firedOrderId })) {
+            this.health.firesSucceeded++;
+        }
     }
     async patchResult(proposalId, body) {
+        const claimToken = this.claimTokens.get(proposalId);
+        if (!claimToken) {
+            this.health.patchFailures++;
+            logger.error(TAG, `Refusing fire-result for unclaimed proposal ${proposalId}`);
+            return;
+        }
+        // Persist locally before the HTTP attempt. Any lost/failed response retries
+        // only this PATCH; createOrderTool is never invoked again.
+        this.pendingResults.set(proposalId, body);
         const url = `${this.opts.baseUrl}/api/internal/proposed_orders/${proposalId}/fire-result`;
         try {
             const ac = new AbortController();
@@ -265,7 +423,7 @@ export class ProposalDecisionListener {
                         authorization: `Bearer ${this.opts.ingestToken}`,
                         'x-user-id': this.opts.userId,
                     },
-                    body: JSON.stringify(body),
+                    body: JSON.stringify({ claimToken, ...body }),
                     signal: ac.signal,
                 });
             }
@@ -273,9 +431,12 @@ export class ProposalDecisionListener {
                 clearTimeout(tid);
             }
             if (res.status === 409) {
-                // Already-recorded race — listener double-fired but webapp's idempotency
-                // guard caught the duplicate. Not an error.
-                logger.info(TAG, `Proposal ${proposalId} fire-result already recorded (409, expected on retry)`);
+                this.health.patchFailures++;
+                logger.error(TAG, `Proposal ${proposalId} fire-result claim mismatch (409)`);
+                // Never retry the exchange mutation. Exact lost-response retries are
+                // 200; a 409 means this process cannot commit the result and the
+                // durable claim must be reconciled manually.
+                this.forgetClaim(proposalId);
                 return;
             }
             if (!res.ok) {
@@ -283,6 +444,8 @@ export class ProposalDecisionListener {
                 logger.warn(TAG, `PATCH ${url} → ${res.status}`);
                 return;
             }
+            this.forgetClaim(proposalId);
+            return true;
         }
         catch (err) {
             this.health.patchFailures++;

package/onboarding/runtime.d.ts

@@ -3,14 +3,31 @@ import type { ExchangeConfig, TradingMode } from '../types.js';
 import type { ExchangeSimulator } from '../simulator/exchange-simulator.js';
 import type { PaperMarketFeed } from '../simulator/paper-market-feed.js';
 import { LiveAdapter } from '../live/live-adapter.js';
+import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
 import type { HlCredentials } from '../venues/hyperliquid/hl-private.js';
 import { type VenueId } from '../venues/registry.js';
 import { PositionWatcher } from '../live/stop-watcher.js';
+import type { TradeStoreClient } from '../ingest/trade-store-client.js';
+import type { AutoCaptureContext } from '../ingest/position-auto-capture.js';
 import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
 export interface MicroLiveConfig {
-    sizeCapPercent?: number;
     maxPositionUSDT?: number;
 }
+/** Boot-constructed live wiring reapplied to EVERY adapter build (audit
+ *  2026-07-26 F9). Reconnects previously rebuilt adapters with only the
+ *  bracket mode — silently reverting WS authority to REST, dropping the
+ *  audit-trail ingest, and losing journal auto-capture until restart. The
+ *  clients live for the process lifetime (the SIGTERM drain holds them), so
+ *  rebuilds must REUSE them, never re-instantiate. */
+export interface LiveAdapterWiring {
+    /** Base of TradeIngestWiring — `exchange` is stamped per build from the
+     *  TARGET venue (fillExchangeId), because a venue flip changes it. */
+    tradeIngestBase?: {
+        client: TradeStoreClient;
+        userId: string;
+    };
+    autoCapture?: AutoCaptureContext;
+}
 export interface BuildAdapterInput {
     mode: TradingMode;
     exchange: ExchangeConfig | null;
@@ -24,6 +41,8 @@ export interface BuildAdapterInput {
     venue?: VenueId;
     /** Required for a live-mode build on the hyperliquid venue. */
     hlCredentials?: HlCredentials | null;
+    /** Boot wiring reapplied on every build — see LiveAdapterWiring (F9). */
+    wiring?: LiveAdapterWiring;
 }
 /** Wave 9 safety wiring is created only after its durable ledger is loaded.
  *  Runtime reapplies these hooks to both the bootstrap objects and every
@@ -62,6 +81,17 @@ export declare class PluginRuntime {
      *  for watcher closes (issue #199) — without it, a live<->paper reconnect
      *  would silently shed the capture wiring. */
     private readonly onWatcherCreated?;
+    /** Observer applied to EVERY live adapter this runtime creates (audit F9,
+     *  same pattern as onWatcherCreated). index.ts uses it to install the
+     *  drift_detected → journal close-bypass cleanup listener — previously
+     *  installed only on the BOOT adapter and lost on every reconnect. */
+    private readonly onAdapterCreated?;
+    /** Boot live wiring threaded into every buildAdapter call (audit F9). */
+    private readonly liveWiring?;
+    /** Fired after EVERY reconnect publishes its adapter (paper ones included) —
+     *  set post-construction because its consumer (the approval-listener
+     *  lifecycle, audit F10) is built after the runtime. */
+    private onAdapterSwapped?;
     /** Reconnect is serialized — a second caller waits for the first to finish
      *  so we never tear down an adapter that's mid-rebuild. */
     private reconnectInFlight;
@@ -73,11 +103,14 @@ export declare class PluginRuntime {
         marketFeed?: PaperMarketFeed | null;
         operationLock?: TradingOperationLock;
         onWatcherCreated?: (watcher: PositionWatcher) => void;
+        onAdapterCreated?: (adapter: LiveAdapter | HyperliquidLiveAdapter) => void;
+        liveWiring?: LiveAdapterWiring;
     });
     get adapter(): IExchangeAdapter;
     get mode(): TradingMode;
     get stopWatcher(): PositionWatcher | null;
     get marketFeed(): PaperMarketFeed | null;
+    setOnAdapterSwapped(cb?: (adapter: IExchangeAdapter) => void): void;
     setWave9LiveLifecycleHooks(hooks?: Wave9LiveLifecycleHooks): void;
     /**
      * Swap the current adapter for a new one built from `next`. The old

package/onboarding/runtime.js

@@ -14,10 +14,11 @@
 import { PaperAdapter } from '../paper-adapter.js';
 import { LiveAdapter } from '../live/live-adapter.js';
 import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
-import { createLiveAdapter } from '../venues/registry.js';
+import { createLiveAdapter, fillExchangeId } from '../venues/registry.js';
 import { PositionWatcher } from '../live/stop-watcher.js';
 import { loadBracketMode } from '../config/brackets-config.js';
-import { loadStopWatcherIntervalMs, readPluginConfig } from '../config/plugin-config-io.js';
+import { loadMicroLiveConfig, loadStopWatcherIntervalMs, readPluginConfig } from '../config/plugin-config-io.js';
+import { loadUserDataStreamMode, loadUserDataStreamTunables } from '../config/user-data-stream-config.js';
 import { logger, formatError } from '../logger.js';
 const TAG = 'plugin-runtime';
 /** Pure-ish factory: builds an adapter for the requested mode.
@@ -25,12 +26,27 @@ const TAG = 'plugin-runtime';
  *  callers should pre-validate via `modeRequiresCredentials`, but this
  *  defense-in-depth prevents a crash if validation is bypassed. */
 export function buildAdapter(input) {
-    const { mode, exchange, microLive, simulator } = input;
+    const { mode, exchange, simulator } = input;
     if (mode === 'PAPER' || mode === 'SHADOW') {
         // Shadow mode uses a paper adapter for execution; the separate
         // ShadowTracker wraps a BinancePrivateApi for real-balance comparison.
         return new PaperAdapter(simulator);
     }
+    // Micro-live cap resolves from plugin-config at adapter build time when the
+    // caller didn't pass one — every reconnect path (mode flip, credential save)
+    // used to omit it, silently resetting an operator-raised OR -lowered cap
+    // back to the $50 default (audit 2026-07-26 F8).
+    const microLive = input.microLive ?? loadMicroLiveConfig();
+    // Audit-trail ingest (F9): reuse the boot-constructed client, stamp the
+    // exchange id from the TARGET venue (a venue flip changes it; the id is
+    // half of the trades idempotency key and must never be stale or minted).
+    const tradeIngest = input.wiring?.tradeIngestBase
+        ? {
+            client: input.wiring.tradeIngestBase.client,
+            userId: input.wiring.tradeIngestBase.userId,
+            exchange: fillExchangeId(input.venue ?? 'binance'),
+        }
+        : undefined;
     // Hyperliquid live (issue #217): mirror the boot path's construction —
     // per-venue credential shape, the SAME factory (createLiveAdapter), and
     // the same fall-back-to-paper defense when credentials are absent.
@@ -45,6 +61,8 @@ export function buildAdapter(input) {
                 credentials: input.hlCredentials,
                 mode: mode,
                 marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
+                microLive,
+                tradeIngest,
             },
         });
     }
@@ -55,7 +73,12 @@ export function buildAdapter(input) {
     // Read bracket-mode from plugin-config at adapter build time so a config
     // flip + "Reconnect Exchange" pattern picks up the new mode on the next swap.
     const bracketMode = loadBracketMode();
-    return new LiveAdapter(exchange, mode, microLive, bracketMode);
+    // Same read-at-build-time rule for the user-data stream (F9): a rebuilt
+    // adapter wires its WS at construction, so passing nothing here reverted
+    // prod's `enforce` to REST-only polling on every dashboard reconnect.
+    const userDataStreamMode = loadUserDataStreamMode();
+    const userDataStreamTunables = loadUserDataStreamTunables();
+    return new LiveAdapter(exchange, mode, microLive, bracketMode, userDataStreamMode, userDataStreamTunables, tradeIngest, input.wiring?.autoCapture);
 }
 /**
  * Mutable runtime holder. Held once per plugin registration.
@@ -82,6 +105,17 @@ export class PluginRuntime {
      *  for watcher closes (issue #199) — without it, a live<->paper reconnect
      *  would silently shed the capture wiring. */
     onWatcherCreated;
+    /** Observer applied to EVERY live adapter this runtime creates (audit F9,
+     *  same pattern as onWatcherCreated). index.ts uses it to install the
+     *  drift_detected → journal close-bypass cleanup listener — previously
+     *  installed only on the BOOT adapter and lost on every reconnect. */
+    onAdapterCreated;
+    /** Boot live wiring threaded into every buildAdapter call (audit F9). */
+    liveWiring;
+    /** Fired after EVERY reconnect publishes its adapter (paper ones included) —
+     *  set post-construction because its consumer (the approval-listener
+     *  lifecycle, audit F10) is built after the runtime. */
+    onAdapterSwapped;
     /** Reconnect is serialized — a second caller waits for the first to finish
      *  so we never tear down an adapter that's mid-rebuild. */
     reconnectInFlight = null;
@@ -93,11 +127,16 @@ export class PluginRuntime {
         this._marketFeed = initial.marketFeed ?? null;
         this.operationLock = initial.operationLock;
         this.onWatcherCreated = initial.onWatcherCreated;
+        this.onAdapterCreated = initial.onAdapterCreated;
+        this.liveWiring = initial.liveWiring;
     }
     get adapter() { return this._adapter; }
     get mode() { return this._mode; }
     get stopWatcher() { return this._stopWatcher; }
     get marketFeed() { return this._marketFeed; }
+    setOnAdapterSwapped(cb) {
+        this.onAdapterSwapped = cb;
+    }
     setWave9LiveLifecycleHooks(hooks) {
         this.wave9LiveLifecycleHooks = hooks;
         if (this._adapter instanceof LiveAdapter) {
@@ -160,7 +199,9 @@ export class PluginRuntime {
                 logger.warn(TAG, `old HL adapter stop failed: ${formatError(err)}`);
             }
         }
-        // 3. Build the new adapter.
+        // 3. Build the new adapter — with the boot live wiring, so a reconnect
+        //    can never silently shed WS authority / audit ingest / auto-capture
+        //    (audit F9).
         const fresh = buildAdapter({
             mode: next.mode,
             exchange: next.exchange,
@@ -168,12 +209,18 @@ export class PluginRuntime {
             simulator: this.simulator,
             venue: next.venue,
             hlCredentials: next.hlCredentials,
+            wiring: this.liveWiring,
         });
         // Install autonomous protection callbacks before initialization can emit
         // user-data or bracket-reconciler events.
         if (fresh instanceof LiveAdapter) {
             this.wave9LiveLifecycleHooks?.configureLiveAdapter?.(fresh);
         }
+        // Same before-init rule for the drift_detected journal cleanup (F9): the
+        // reconciler can emit on its first poll.
+        if (fresh instanceof LiveAdapter || fresh instanceof HyperliquidLiveAdapter) {
+            this.onAdapterCreated?.(fresh);
+        }
         // 4. Fire async init for live adapters (non-blocking — readiness flips
         //    INIT_PENDING → READY/DEGRADED/BLOCKED on its own).
         if (fresh instanceof LiveAdapter || fresh instanceof HyperliquidLiveAdapter) {
@@ -210,6 +257,10 @@ export class PluginRuntime {
                 this._marketFeed.start();
             }
         }
+        // 8. Notify swap observers (approval-listener lifecycle etc. — F10).
+        //    Fired for EVERY swap including paper, so a live→PAPER flip can tear
+        //    down consumers bound to the orphaned live adapter.
+        this.onAdapterSwapped?.(fresh);
         logger.info(TAG, `Reconnect complete: now in ${this._mode} mode (readiness=${fresh.readiness})`);
     }
 }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Supervised trading plugin for the ReefClaw dashboard: paper trading with real market data (no API keys required), and optional live trading on Binance or Hyperliquid behind explicit operator opt-in, exchange API credentials, and always-on protective stop brackets. Includes the dashboard connector bridge, heartbeat automation, and remote SKILL.md instruction updates from the ReefClaw webapp.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "ReefClaw supervised trading plugin for OpenClaw \u2014 paper trading with real market data, optional live trading on Binance or Hyperliquid (operator opt-in, API keys, always-on protective brackets), plus the ReefClaw dashboard connector with heartbeat automation and remote SKILL.md updates from the ReefClaw webapp. Install: /plugins install clawhub:@reefclaw/openclaw-plugin",
   "type": "module",
   "main": "index.js",
@@ -22,7 +22,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@reefclaw/shared": "0.1.2",
+    "@reefclaw/shared": "0.1.3",
     "ccxt": "4.5.37",
     "json5": "2.2.3",
     "ws": "8.19.0"