@reefclaw/openclaw-plugin 0.1.12 → 0.1.14

package/simulator/exchange-simulator.d.ts

@@ -4,6 +4,9 @@ import type { CcxtOrder, CcxtBalance, CcxtPosition, CcxtTicker } from '../types.
 export declare class ExchangeSimulator extends EventEmitter {
     private state;
     private lastTicker;
+    /** Symbols with a take-profit close in flight — suppresses a re-entrant
+     *  tick firing a second close on the same position. */
+    private takeProfitPending;
     private lastOrderBook;
     private simulationConfig;
     /** Metadata for pending limit orders, keyed by order ID. Cleaned up on fill/cancel. */
@@ -46,10 +49,21 @@ export declare class ExchangeSimulator extends EventEmitter {
     /** Cache the latest order book snapshot for a symbol. */
     updateOrderBook(symbol: string, orderbook: OrderBookDepth): void;
     getLastOrderBook(symbol: string): OrderBookDepth | undefined;
-    createOrder(symbol: string, side: 'buy' | 'sell', type: 'market' | 'limit', amount: number, price?: number, metadata?: PositionMetadata): CcxtOrder;
+    createOrder(symbol: string, side: 'buy' | 'sell', type: 'market' | 'limit', amount: number, price?: number, metadata?: PositionMetadata, 
+    /** Paper-only market-fill price override (take-profit leg). When set, the
+     *  market branch prices off THIS instead of the last tick, and skips the
+     *  stale-quote guard — the caller supplied the price, so quote age is
+     *  irrelevant, and a protective exit must never be blocked (issue #202). */
+    referencePrice?: number): CcxtOrder;
     cancelOrder(orderId: string): CcxtOrder;
     cancelAllOrders(symbol?: string): CcxtOrder[];
-    closePosition(symbol: string, closeReason?: CloseReason): CcxtOrder;
+    /**
+     * @param referencePrice Paper-only fill-price override. Used by the
+     *   take-profit leg to fill AT the target level instead of the (possibly
+     *   gapped-past) tick price — see `checkTakeProfitLegs`. Omitted everywhere
+     *   else, which keeps the normal market-close path byte-identical.
+     */
+    closePosition(symbol: string, closeReason?: CloseReason, referencePrice?: number): CcxtOrder;
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip
      *  (which pays an extra taker fee and resets the R/MFE denominators). The
@@ -63,6 +77,35 @@ export declare class ExchangeSimulator extends EventEmitter {
     }): void;
     updateTicker(ticker: CcxtTicker): void;
     getLastTicker(symbol: string): CcxtTicker | undefined;
+    /**
+     * Take-profit legs — the paper analog of the exchange-native
+     * `TAKE_PROFIT_MARKET` order live attaches at entry.
+     *
+     * ★ Why this exists: paper STORED `metadata.targetPrice` and surfaced it
+     * (chart line, positions table) but nothing ever closed on it, so the TP was
+     * a drawing rather than an order. Every paper winner ran straight past its
+     * exit — observed live 2026-07-27 on an OP/USDT short that reached +2.07R
+     * against a 1.0R target. That made paper the odd one out of three: the
+     * BACKTEST exits at target (`backtest/engine.ts` exitReason 'target') and
+     * LIVE exits at target (Binance TP_MARKET leg / HL coordinator TP leg), so
+     * a strategy forward-validated on paper was being measured on a book that
+     * let every winner run.
+     *
+     * Fill convention: the TARGET LEVEL is the decision price, and the normal
+     * realistic-fill engine applies its own adverse slippage around it (book
+     * VWAP + vol factor + taker fee) — the same model every other paper fill
+     * uses, rather than a second hand-rolled slippage constant. When a tick gaps
+     * past the target we deliberately do NOT credit the gap: filling at the
+     * level is worse for us than filling at the gapped tick, so this stays
+     * conservative against both the backtest and a real TP_MARKET (which would
+     * fill at the gapped price).
+     *
+     * Stops stay with the PositionWatcher: it is the safety floor and re-homing
+     * it is a separate, riskier change. A single tick can only breach one leg
+     * (stop and target sit on opposite sides of entry), so there is no
+     * stop-vs-target ordering ambiguity to resolve here.
+     */
+    private checkTakeProfitLegs;
     /** Walk every position for `symbol` and refresh MFE / give-back from the
      *  latest mark. Idempotent — pure update of `metadata.mfePeakPrice` (only
      *  ratchets favourably) plus derived `mfeR` and `giveBackRatio`. Safe to

package/simulator/exchange-simulator.js

@@ -6,7 +6,7 @@
 // via SimulationConfig and OrderBookDepth.
 import { EventEmitter } from 'node:events';
 import { randomUUID } from 'node:crypto';
-import { logger } from '../logger.js';
+import { logger, formatError } from '../logger.js';
 import { MAX_TRADE_HISTORY, DEFAULT_SIMULATION_CONFIG } from './types.js';
 import { fillMarketOrder, fillLimitOrder, parseSymbol } from './fill-engine.js';
 import { updateMfe } from '../mfe.js';
@@ -15,6 +15,9 @@ const TAG = 'simulator';
 export class ExchangeSimulator extends EventEmitter {
     state;
     lastTicker = new Map();
+    /** Symbols with a take-profit close in flight — suppresses a re-entrant
+     *  tick firing a second close on the same position. */
+    takeProfitPending = new Set();
     lastOrderBook = new Map();
     simulationConfig;
     /** Metadata for pending limit orders, keyed by order ID. Cleaned up on fill/cancel. */
@@ -247,7 +250,12 @@ export class ExchangeSimulator extends EventEmitter {
         return this.lastOrderBook.get(symbol);
     }
     // ---- Write operations (for tools) ----
-    createOrder(symbol, side, type, amount, price, metadata) {
+    createOrder(symbol, side, type, amount, price, metadata, 
+    /** Paper-only market-fill price override (take-profit leg). When set, the
+     *  market branch prices off THIS instead of the last tick, and skips the
+     *  stale-quote guard — the caller supplied the price, so quote age is
+     *  irrelevant, and a protective exit must never be blocked (issue #202). */
+    referencePrice) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
@@ -281,6 +289,10 @@ export class ExchangeSimulator extends EventEmitter {
             createdAt: now,
         };
         if (type === 'market') {
+            // Explicit fill price (take-profit leg) — see the param doc above.
+            if (referencePrice !== undefined && Number.isFinite(referencePrice) && referencePrice > 0) {
+                return this.executeMarketFill(order, referencePrice, metadata);
+            }
             // Market orders fill immediately at current price
             const ticker = this.lastTicker.get(symbol);
             if (!ticker) {
@@ -345,7 +357,13 @@ export class ExchangeSimulator extends EventEmitter {
         }
         return cancelled.map(o => this.toCcxtOrder(o));
     }
-    closePosition(symbol, closeReason) {
+    /**
+     * @param referencePrice Paper-only fill-price override. Used by the
+     *   take-profit leg to fill AT the target level instead of the (possibly
+     *   gapped-past) tick price — see `checkTakeProfitLegs`. Omitted everywhere
+     *   else, which keeps the normal market-close path byte-identical.
+     */
+    closePosition(symbol, closeReason, referencePrice) {
         const position = this.state.positions.find(p => p.symbol === symbol);
         if (!position) {
             throw new Error(`No open position for ${symbol}`);
@@ -359,7 +377,7 @@ export class ExchangeSimulator extends EventEmitter {
         }
         // Create opposing market order to close the position
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip
@@ -385,6 +403,10 @@ export class ExchangeSimulator extends EventEmitter {
     updateTicker(ticker) {
         this.lastTicker.set(ticker.symbol, ticker);
         this.refreshMfeForSymbol(ticker.symbol, ticker.last);
+        // MFE is refreshed FIRST so the peak this tick reached is recorded before a
+        // target close reads it — otherwise every TP exit would understate its own
+        // MFE and skew the capture-ratio analysis.
+        this.checkTakeProfitLegs(ticker.symbol, ticker.last);
         // Check if any pending limit orders should fill
         const toFill = [];
         const remaining = [];
@@ -429,6 +451,76 @@ export class ExchangeSimulator extends EventEmitter {
     getLastTicker(symbol) {
         return this.lastTicker.get(symbol);
     }
+    /**
+     * Take-profit legs — the paper analog of the exchange-native
+     * `TAKE_PROFIT_MARKET` order live attaches at entry.
+     *
+     * ★ Why this exists: paper STORED `metadata.targetPrice` and surfaced it
+     * (chart line, positions table) but nothing ever closed on it, so the TP was
+     * a drawing rather than an order. Every paper winner ran straight past its
+     * exit — observed live 2026-07-27 on an OP/USDT short that reached +2.07R
+     * against a 1.0R target. That made paper the odd one out of three: the
+     * BACKTEST exits at target (`backtest/engine.ts` exitReason 'target') and
+     * LIVE exits at target (Binance TP_MARKET leg / HL coordinator TP leg), so
+     * a strategy forward-validated on paper was being measured on a book that
+     * let every winner run.
+     *
+     * Fill convention: the TARGET LEVEL is the decision price, and the normal
+     * realistic-fill engine applies its own adverse slippage around it (book
+     * VWAP + vol factor + taker fee) — the same model every other paper fill
+     * uses, rather than a second hand-rolled slippage constant. When a tick gaps
+     * past the target we deliberately do NOT credit the gap: filling at the
+     * level is worse for us than filling at the gapped tick, so this stays
+     * conservative against both the backtest and a real TP_MARKET (which would
+     * fill at the gapped price).
+     *
+     * Stops stay with the PositionWatcher: it is the safety floor and re-homing
+     * it is a separate, riskier change. A single tick can only breach one leg
+     * (stop and target sit on opposite sides of entry), so there is no
+     * stop-vs-target ordering ambiguity to resolve here.
+     */
+    checkTakeProfitLegs(symbol, price) {
+        if (!Number.isFinite(price) || price <= 0)
+            return;
+        // Snapshot: closing mutates state.positions mid-iteration.
+        const candidates = this.state.positions.filter((p) => p.symbol === symbol);
+        for (const position of candidates) {
+            const target = position.metadata?.targetPrice;
+            if (target === undefined || !Number.isFinite(target) || target <= 0)
+                continue;
+            const breached = position.side === 'long' ? price >= target : price <= target;
+            if (!breached)
+                continue;
+            // Guard against a re-entrant tick firing a second close on the same
+            // symbol while the first is still settling.
+            if (this.takeProfitPending.has(symbol))
+                continue;
+            this.takeProfitPending.add(symbol);
+            try {
+                logger.info(TAG, `TARGET REACHED: ${symbol} ${position.side} price=${price} target=${target} — closing (exchange_target)`);
+                // Target = decision price; the fill engine adds realistic adverse
+                // slippage on top (see the fill-convention note above).
+                const order = this.closePosition(symbol, 'exchange_target', target);
+                this.emit('target_closed', {
+                    symbol,
+                    side: position.side,
+                    targetPrice: target,
+                    markPrice: price,
+                    fillPrice: typeof order.average === 'number' ? order.average : target,
+                    quantity: position.quantity,
+                    order,
+                });
+            }
+            catch (err) {
+                // Never let a failed protective close kill the tick loop — the next
+                // tick retries, and the position is still visible to the agent.
+                logger.error(TAG, `Target close failed for ${symbol}: ${formatError(err)}`);
+            }
+            finally {
+                this.takeProfitPending.delete(symbol);
+            }
+        }
+    }
     /** Walk every position for `symbol` and refresh MFE / give-back from the
      *  latest mark. Idempotent — pure update of `metadata.mfePeakPrice` (only
      *  ratchets favourably) plus derived `mfeR` and `giveBackRatio`. Safe to

package/simulator/types.d.ts

@@ -1,3 +1,4 @@
+import type { CcxtOrder } from '../types.js';
 export interface FillError {
     orderId: string;
     symbol: string;
@@ -76,6 +77,22 @@ export interface ExecutionStats {
 export interface Wallet {
     [currency: string]: CurrencyBalance;
 }
+/** Emitted when the paper take-profit leg fires (`ExchangeSimulator`
+ *  'target_closed'). The live analog is an exchange-native TAKE_PROFIT_MARKET
+ *  fill; index.ts journals this the same way it journals a stop-watcher close,
+ *  so a target exit can never leave a phantom-open journal row (issue #199). */
+export interface TargetClosedEvent {
+    symbol: string;
+    side: 'long' | 'short';
+    /** The pinned target level that was breached. */
+    targetPrice: number;
+    /** The tick price that breached it (may have gapped past the target). */
+    markPrice: number;
+    /** Where we actually filled — the target level with adverse slippage. */
+    fillPrice: number;
+    quantity: number;
+    order: CcxtOrder;
+}
 export interface CurrencyBalance {
     total: number;
     available: number;

package/tools/attach-brackets.js

@@ -323,13 +323,28 @@ async function attachBracketsHl(args, adapter) {
     let clearedStaleLedgerRow = false;
     if (existing && !isTerminalBracketState(existing.state)) {
         let cls = 'unknown';
+        // Per-LEG liveness (audit 2026-07-26 F4): "either cid survives ⇒ live"
+        // let a TP-only position no-op as "already protected" indefinitely while
+        // its stop was gone. A registered leg positively absent from a NON-EMPTY
+        // order set is a protection gap this tool must repair, not paper over.
+        const missingLegs = [];
         const hasCids = Boolean(existing.slCid || existing.tpCid);
         if (hasCids) {
             try {
                 const open = await adapter.getOpenOrders(position.symbol);
                 const liveCids = new Set(open.map(o => o.clientOrderId).filter(Boolean));
-                if ((existing.slCid && liveCids.has(existing.slCid)) || (existing.tpCid && liveCids.has(existing.tpCid))) {
+                const stopLive = Boolean(existing.slCid && liveCids.has(existing.slCid));
+                const tpLive = Boolean(existing.tpCid && liveCids.has(existing.tpCid));
+                if (stopLive || tpLive) {
                     cls = 'live';
+                    if (open.length > 0) {
+                        // Non-empty set = positive evidence for absence (d59e51b) — a
+                        // registered-but-absent sibling is a repairable gap.
+                        if (existing.slCid && !stopLive)
+                            missingLegs.push('stop');
+                        if (existing.tpCid && !tpLive)
+                            missingLegs.push('target');
+                    }
                 }
                 else if (open.length > 0) {
                     cls = 'stale'; // non-empty set positively lacking our cids
@@ -351,6 +366,40 @@ async function attachBracketsHl(args, adapter) {
         if (cls === 'live') {
             if (pricesMatch(args.stop_price, existing.stopPrice)
                 && pricesMatch(args.target_price, existing.targetPrice)) {
+                if (missingLegs.length > 0) {
+                    // One registered leg is positively gone (a stop-less position is a
+                    // safety-floor breach). Rebuild it at the registered price via the
+                    // resize path — planResize submits ONLY the missing leg and leaves
+                    // the healthy sibling untouched (F4).
+                    try {
+                        const coordinator = adapter.getHlBracketCoordinator();
+                        await coordinator.resizeToPosition(position.symbol, contracts);
+                        const healed = ledger.getBySymbol(position.symbol);
+                        return {
+                            ok: true,
+                            symbol: position.symbol,
+                            bracket_id: existing.bracketId,
+                            entry_side: entrySide,
+                            stop_price: existing.stopPrice,
+                            target_price: existing.targetPrice,
+                            sl_cid: healed?.slCid ?? existing.slCid,
+                            tp_cid: healed?.tpCid ?? existing.tpCid,
+                            attach_latency_ms: 0,
+                            cancelled_stale_bracket_orders: 0,
+                            cleared_stale_ledger_row: false,
+                            attempts: 1,
+                            idempotent_no_op: false,
+                            note: `Missing ${missingLegs.join('+')} leg re-attached at the registered price(s); sibling leg untouched.`,
+                        };
+                    }
+                    catch (err) {
+                        return {
+                            error: `Registered ${missingLegs.join('+')} leg is GONE from the exchange and the rebuild ` +
+                                `failed (${formatError(err)}). The position is under-protected — retry attach_brackets ` +
+                                `next heartbeat; the 60s truth sweep also retries. Do NOT record a protected review.`,
+                        };
+                    }
+                }
                 return {
                     ok: true,
                     symbol: position.symbol,

package/tools/create-order.d.ts

@@ -17,6 +17,14 @@ type Wave9LiveResidualProtector = (adapter: IExchangeAdapter, ledger: Wave9LiveE
  *  buildHlOrderCloid() mints the 0x0d… ORDER prefix, which the bracket parser
  *  deliberately never recognises (cross-scheme cancels are destructive). */
 export declare function mintEntryStashCid(adapter: IExchangeAdapter): string;
+/** Stable exchange idempotency key for one approved proposal.
+ *
+ * A listener can crash after exchange acceptance but before fire-result is
+ * persisted. Reconciliation must query the exact same client-order ID instead
+ * of submitting with a freshly generated one. Binance permits 36-character
+ * ASCII IDs; Hyperliquid requires exactly 128 bits of hex.
+ */
+export declare function proposalEntryClientOrderId(adapter: IExchangeAdapter, proposalUuid: string): string;
 export declare function createOrderTool(args: {
     symbol: string;
     side: string;
@@ -61,6 +69,9 @@ export declare function createOrderTool(args: {
     proposalManager?: ProposalManager;
     userId?: string;
     approvalMode?: 'off' | 'shadow' | 'per_trade';
+    /** Internal listener-only override. Keeps one approved proposal bound to a
+     * deterministic exchange idempotency key across reconciliation/restart. */
+    entryClientOrderId?: string;
     wave9AdmissionGuard?: Wave9PaperAdmissionGuard;
     wave9ActivationCheck?: () => Promise<{
         available: boolean;

package/tools/create-order.js

@@ -1,6 +1,6 @@
 // Tool: create_order — order execution with real price data + pre-trade risk gate
 // Readiness gate: BLOCKED unless adapter.readiness === 'READY'.
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { formatError } from '../logger.js';
 import { getQuoteBalance, getQuoteWalletBalance } from '../balance-utils.js';
 import { fetchCurrentPrice, fetchOrderBook, isError } from './helpers.js';
@@ -242,6 +242,27 @@ function candidateBoundFoundOrder(resolution, clientOrderId, symbol, side) {
 export function mintEntryStashCid(adapter) {
     return adapter instanceof HyperliquidLiveAdapter ? buildHlOrderCloid() : randomUUID();
 }
+/** Stable exchange idempotency key for one approved proposal.
+ *
+ * A listener can crash after exchange acceptance but before fire-result is
+ * persisted. Reconciliation must query the exact same client-order ID instead
+ * of submitting with a freshly generated one. Binance permits 36-character
+ * ASCII IDs; Hyperliquid requires exactly 128 bits of hex.
+ */
+export function proposalEntryClientOrderId(adapter, proposalUuid) {
+    const hex = proposalUuid.replace(/-/g, '').toLowerCase();
+    if (!/^[0-9a-f]{32}$/.test(hex)) {
+        throw new Error('proposalUuid must be a UUID');
+    }
+    if (adapter instanceof HyperliquidLiveAdapter) {
+        // Keep deterministic entries in the same 0x0d plain-order namespace as
+        // buildHlOrderCloid(). Using the UUID bytes directly could begin with
+        // bc7[e57] and be misclassified as a managed bracket leg.
+        const digest = createHash('sha256').update(hex).digest('hex');
+        return `0x0d${digest.slice(0, 30)}`;
+    }
+    return `rcp-${hex}`;
+}
 async function resolveWave9EntryCid(adapter, clientOrderId, symbol) {
     if (!adapter.resolveOrderByClientId) {
         return { status: 'unknown', detail: 'deterministic client-order resolver is unavailable' };
@@ -1142,7 +1163,7 @@ export async function createOrderTool(args, deps) {
             // throws, the unused stash entry simply expires (24h TTL, pruned).
             let stashCid = wave9Claimed && initialWave9Mode === 'LIVE'
                 ? wave9ClientOrderId(args.candidate_id)
-                : undefined;
+                : deps.entryClientOrderId;
             if (deps.autoCapture?.pendingEntries && metadata) {
                 stashCid ??= mintEntryStashCid(deps.adapter);
                 deps.autoCapture.pendingEntries.put({

package/tools/get-risk-summary.d.ts

@@ -41,6 +41,10 @@ export interface RiskSummaryResult {
         readyForUpgrade: boolean;
         upgradeBlockers: string[];
     };
+    /** Present only when an input field was missing/non-finite and a substitute
+     *  was used. Honest degradation: the numbers above still render, and the
+     *  agent is TOLD which ones are not straight from the exchange. */
+    dataWarnings?: string[];
     timestamp: string;
 }
 export declare function getRiskSummaryTool(_args: Record<string, never>, deps: {

package/tools/get-risk-summary.js

@@ -2,6 +2,26 @@
 // Returns exposure, drawdown, heat score, position count — everything
 // the agent needs for risk-aware decision making.
 import { getQuoteBalance, getQuoteWalletBalance } from '../balance-utils.js';
+/** Finite number or undefined — never NaN, never a silent 0. */
+function fin(v) {
+    if (v === undefined || v === null || v === '')
+        return undefined;
+    const n = typeof v === 'number' ? v : Number(v);
+    return Number.isFinite(n) ? n : undefined;
+}
+/** Round for display without ever throwing.
+ *
+ *  ★ This tool is read-only observability — it must DEGRADE, never crash. It used
+ *  to call `.toFixed()` straight on adapter fields, and on Hyperliquid live
+ *  (where ccxt leaves `markPrice` undefined) that took the whole tool down with
+ *  `Cannot read properties of undefined (reading 'toFixed')` — the agent lost its
+ *  entire risk read because one display field was absent. The venue-side root
+ *  cause is fixed in `venues/hyperliquid/hl-position.ts`; this is the backstop
+ *  for every other adapter/field. */
+function round(v, dp) {
+    const n = fin(v);
+    return n === undefined ? 0 : +n.toFixed(dp);
+}
 export async function getRiskSummaryTool(_args, deps) {
     // In live modes, use real exchange data instead of simulator
     let balance;
@@ -27,23 +47,41 @@ export async function getRiskSummaryTool(_args, deps) {
     let longExposure = 0;
     let shortExposure = 0;
     let totalUnrealizedPnl = 0;
+    const dataWarnings = [];
     const positionDetails = positions.map((pos) => {
-        const notional = Math.abs(pos.notional);
+        const entryPrice = fin(pos.entryPrice);
+        const rawMark = fin(pos.markPrice);
+        // Same convention as pre-trade-check / create-order: an absent mark falls
+        // back to entry (a $0 mark would read as a total loss), and we say so.
+        const markPrice = rawMark ?? entryPrice;
+        if (rawMark === undefined) {
+            dataWarnings.push(`${pos.symbol}: mark price unavailable from the exchange — entry price substituted (uPnL/exposure may be stale)`);
+        }
+        if (entryPrice === undefined) {
+            dataWarnings.push(`${pos.symbol}: entry price unavailable from the exchange`);
+        }
+        const quantity = fin(pos.contracts) ?? 0;
+        const rawNotional = fin(pos.notional);
+        const notional = rawNotional !== undefined ? Math.abs(rawNotional) : Math.abs(quantity * (markPrice ?? 0));
+        const unrealizedPnl = fin(pos.unrealizedPnl);
+        if (unrealizedPnl === undefined) {
+            dataWarnings.push(`${pos.symbol}: unrealized PnL unavailable from the exchange — counted as 0`);
+        }
         grossExposure += notional;
         if (pos.side === 'long')
             longExposure += notional;
         else
             shortExposure += notional;
-        totalUnrealizedPnl += pos.unrealizedPnl;
+        totalUnrealizedPnl += unrealizedPnl ?? 0;
         return {
             symbol: pos.symbol,
             side: pos.side,
-            quantity: pos.contracts,
-            entryPrice: +pos.entryPrice.toFixed(2),
-            markPrice: +pos.markPrice.toFixed(2),
-            notional: +notional.toFixed(2),
-            unrealizedPnl: +pos.unrealizedPnl.toFixed(2),
-            portfolioPercent: totalEquity > 0 ? +((notional / totalEquity) * 100).toFixed(1) : 0,
+            quantity,
+            entryPrice: round(entryPrice, 2),
+            markPrice: round(markPrice, 2),
+            notional: round(notional, 2),
+            unrealizedPnl: round(unrealizedPnl, 2),
+            portfolioPercent: totalEquity > 0 ? round((notional / totalEquity) * 100, 1) : 0,
         };
     });
     const netExposure = longExposure - shortExposure;
@@ -76,10 +114,10 @@ export async function getRiskSummaryTool(_args, deps) {
     const executionStats = execStats && execStats.totalTrades > 0
         ? {
             totalTrades: execStats.totalTrades,
-            avgSlippageBps: +execStats.avgSlippageBps.toFixed(2),
-            worstSlippageBps: +execStats.worstSlippageBps.toFixed(2),
-            totalFeesPaid: +execStats.totalFeesPaid.toFixed(2),
-            avgLatencyMs: +execStats.avgLatencyMs.toFixed(0),
+            avgSlippageBps: round(execStats.avgSlippageBps, 2),
+            worstSlippageBps: round(execStats.worstSlippageBps, 2),
+            totalFeesPaid: round(execStats.totalFeesPaid, 2),
+            avgLatencyMs: round(execStats.avgLatencyMs, 0),
         }
         : undefined;
     // Shadow metrics (Phase 9b)
@@ -89,8 +127,8 @@ export async function getRiskSummaryTool(_args, deps) {
         const upgrade = deps.shadowTracker.isReadyForUpgrade();
         shadowMetrics = {
             totalShadowTrades: sm.totalShadowTrades,
-            avgDeltaBps: +sm.avgDeltaBps.toFixed(2),
-            worstDeltaBps: +sm.worstDeltaBps.toFixed(2),
+            avgDeltaBps: round(sm.avgDeltaBps, 2),
+            worstDeltaBps: round(sm.worstDeltaBps, 2),
             tradingDays: sm.tradingDays,
             readyForUpgrade: upgrade.ready,
             upgradeBlockers: upgrade.reasons,
@@ -98,21 +136,22 @@ export async function getRiskSummaryTool(_args, deps) {
     }
     return {
         tradingMode: deps.tradingMode ?? 'PAPER',
-        totalEquity: +totalEquity.toFixed(2),
-        availableBalance: +availableBalance.toFixed(2),
-        lockedBalance: +lockedBalance.toFixed(2),
-        grossExposure: +grossExposure.toFixed(2),
-        grossExposurePercent: +grossExposurePercent.toFixed(1),
-        netExposure: +netExposure.toFixed(2),
-        netExposurePercent: +netExposurePercent.toFixed(1),
+        totalEquity: round(totalEquity, 2),
+        availableBalance: round(availableBalance, 2),
+        lockedBalance: round(lockedBalance, 2),
+        grossExposure: round(grossExposure, 2),
+        grossExposurePercent: round(grossExposurePercent, 1),
+        netExposure: round(netExposure, 2),
+        netExposurePercent: round(netExposurePercent, 1),
         positionCount: positions.length,
-        unrealizedPnl: +totalUnrealizedPnl.toFixed(2),
-        unrealizedPnlPercent: +unrealizedPnlPercent.toFixed(2),
+        unrealizedPnl: round(totalUnrealizedPnl, 2),
+        unrealizedPnlPercent: round(unrealizedPnlPercent, 2),
         positions: positionDetails,
         heatScore,
         heatLevel,
         executionStats,
         shadowMetrics,
+        ...(dataWarnings.length > 0 ? { dataWarnings } : {}),
         timestamp: new Date().toISOString(),
     };
 }

package/venues/hyperliquid/hl-bracket-coordinator.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { CcxtOrder, CcxtPosition } from '../../types.js';
 import type { CloseReason } from '../../simulator/types.js';
-import type { BracketId, BracketRequest, BracketState } from '../../live/bracket-types.js';
+import type { BracketId, BracketLedgerEntry, BracketRequest, BracketState } from '../../live/bracket-types.js';
 import type { BracketLedger } from '../../live/bracket-ledger.js';
 import type { HlOrderUpdateEvent } from './hl-user-stream.js';
 /** Narrow execution surface the coordinator needs — the HyperliquidLiveAdapter
@@ -24,6 +24,11 @@ export interface HlBracketExecutor {
         symbol: string;
         positionSide: 'long' | 'short';
         positionSize: number;
+        /** Ledger-registered prices — lets resize REBUILD a vanished leg (F4). */
+        registeredPrices?: {
+            stop?: number;
+            target?: number;
+        };
     }): Promise<{
         resized: boolean;
         slCid?: string;
@@ -58,6 +63,10 @@ export interface HlCoordinatorOpts {
     sleep?: (ms: number) => Promise<void>;
 }
 export declare function isTerminalBracketState(state: BracketState): boolean;
+/** A batch item HL rejected. ccxt types status as open|closed|canceled, but a
+ *  per-item rejection surfaces as an `error` entry in the raw batch response
+ *  (`info.error`) — check both shapes rather than trust the narrow type. */
+export declare function isRejectedOrder(o: CcxtOrder | undefined | null): boolean;
 export declare class HlBracketCoordinator extends EventEmitter {
     private readonly executor;
     private readonly ledger;
@@ -84,6 +93,25 @@ export declare class HlBracketCoordinator extends EventEmitter {
      *  fill signal against a non-terminal row is a warned NO-OP, never a fresh
      *  bracketId that orphans the live legs' ledger identity. */
     registerEntry(req: BracketRequest, bracketId: BracketId, entryCid: string): void;
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol: string, entryCid: string): void;
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid: string | undefined | null): BracketLedgerEntry | undefined;
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */