@reefclaw/openclaw-plugin 0.1.13 → 0.1.14

package/onboarding/runtime.d.ts

@@ -3,14 +3,31 @@ import type { ExchangeConfig, TradingMode } from '../types.js';
 import type { ExchangeSimulator } from '../simulator/exchange-simulator.js';
 import type { PaperMarketFeed } from '../simulator/paper-market-feed.js';
 import { LiveAdapter } from '../live/live-adapter.js';
+import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
 import type { HlCredentials } from '../venues/hyperliquid/hl-private.js';
 import { type VenueId } from '../venues/registry.js';
 import { PositionWatcher } from '../live/stop-watcher.js';
+import type { TradeStoreClient } from '../ingest/trade-store-client.js';
+import type { AutoCaptureContext } from '../ingest/position-auto-capture.js';
 import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
 export interface MicroLiveConfig {
-    sizeCapPercent?: number;
     maxPositionUSDT?: number;
 }
+/** Boot-constructed live wiring reapplied to EVERY adapter build (audit
+ *  2026-07-26 F9). Reconnects previously rebuilt adapters with only the
+ *  bracket mode — silently reverting WS authority to REST, dropping the
+ *  audit-trail ingest, and losing journal auto-capture until restart. The
+ *  clients live for the process lifetime (the SIGTERM drain holds them), so
+ *  rebuilds must REUSE them, never re-instantiate. */
+export interface LiveAdapterWiring {
+    /** Base of TradeIngestWiring — `exchange` is stamped per build from the
+     *  TARGET venue (fillExchangeId), because a venue flip changes it. */
+    tradeIngestBase?: {
+        client: TradeStoreClient;
+        userId: string;
+    };
+    autoCapture?: AutoCaptureContext;
+}
 export interface BuildAdapterInput {
     mode: TradingMode;
     exchange: ExchangeConfig | null;
@@ -24,6 +41,8 @@ export interface BuildAdapterInput {
     venue?: VenueId;
     /** Required for a live-mode build on the hyperliquid venue. */
     hlCredentials?: HlCredentials | null;
+    /** Boot wiring reapplied on every build — see LiveAdapterWiring (F9). */
+    wiring?: LiveAdapterWiring;
 }
 /** Wave 9 safety wiring is created only after its durable ledger is loaded.
  *  Runtime reapplies these hooks to both the bootstrap objects and every
@@ -62,6 +81,17 @@ export declare class PluginRuntime {
      *  for watcher closes (issue #199) — without it, a live<->paper reconnect
      *  would silently shed the capture wiring. */
     private readonly onWatcherCreated?;
+    /** Observer applied to EVERY live adapter this runtime creates (audit F9,
+     *  same pattern as onWatcherCreated). index.ts uses it to install the
+     *  drift_detected → journal close-bypass cleanup listener — previously
+     *  installed only on the BOOT adapter and lost on every reconnect. */
+    private readonly onAdapterCreated?;
+    /** Boot live wiring threaded into every buildAdapter call (audit F9). */
+    private readonly liveWiring?;
+    /** Fired after EVERY reconnect publishes its adapter (paper ones included) —
+     *  set post-construction because its consumer (the approval-listener
+     *  lifecycle, audit F10) is built after the runtime. */
+    private onAdapterSwapped?;
     /** Reconnect is serialized — a second caller waits for the first to finish
      *  so we never tear down an adapter that's mid-rebuild. */
     private reconnectInFlight;
@@ -73,11 +103,14 @@ export declare class PluginRuntime {
         marketFeed?: PaperMarketFeed | null;
         operationLock?: TradingOperationLock;
         onWatcherCreated?: (watcher: PositionWatcher) => void;
+        onAdapterCreated?: (adapter: LiveAdapter | HyperliquidLiveAdapter) => void;
+        liveWiring?: LiveAdapterWiring;
     });
     get adapter(): IExchangeAdapter;
     get mode(): TradingMode;
     get stopWatcher(): PositionWatcher | null;
     get marketFeed(): PaperMarketFeed | null;
+    setOnAdapterSwapped(cb?: (adapter: IExchangeAdapter) => void): void;
     setWave9LiveLifecycleHooks(hooks?: Wave9LiveLifecycleHooks): void;
     /**
      * Swap the current adapter for a new one built from `next`. The old

package/onboarding/runtime.js

@@ -14,10 +14,11 @@
 import { PaperAdapter } from '../paper-adapter.js';
 import { LiveAdapter } from '../live/live-adapter.js';
 import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
-import { createLiveAdapter } from '../venues/registry.js';
+import { createLiveAdapter, fillExchangeId } from '../venues/registry.js';
 import { PositionWatcher } from '../live/stop-watcher.js';
 import { loadBracketMode } from '../config/brackets-config.js';
-import { loadStopWatcherIntervalMs, readPluginConfig } from '../config/plugin-config-io.js';
+import { loadMicroLiveConfig, loadStopWatcherIntervalMs, readPluginConfig } from '../config/plugin-config-io.js';
+import { loadUserDataStreamMode, loadUserDataStreamTunables } from '../config/user-data-stream-config.js';
 import { logger, formatError } from '../logger.js';
 const TAG = 'plugin-runtime';
 /** Pure-ish factory: builds an adapter for the requested mode.
@@ -25,12 +26,27 @@ const TAG = 'plugin-runtime';
  *  callers should pre-validate via `modeRequiresCredentials`, but this
  *  defense-in-depth prevents a crash if validation is bypassed. */
 export function buildAdapter(input) {
-    const { mode, exchange, microLive, simulator } = input;
+    const { mode, exchange, simulator } = input;
     if (mode === 'PAPER' || mode === 'SHADOW') {
         // Shadow mode uses a paper adapter for execution; the separate
         // ShadowTracker wraps a BinancePrivateApi for real-balance comparison.
         return new PaperAdapter(simulator);
     }
+    // Micro-live cap resolves from plugin-config at adapter build time when the
+    // caller didn't pass one — every reconnect path (mode flip, credential save)
+    // used to omit it, silently resetting an operator-raised OR -lowered cap
+    // back to the $50 default (audit 2026-07-26 F8).
+    const microLive = input.microLive ?? loadMicroLiveConfig();
+    // Audit-trail ingest (F9): reuse the boot-constructed client, stamp the
+    // exchange id from the TARGET venue (a venue flip changes it; the id is
+    // half of the trades idempotency key and must never be stale or minted).
+    const tradeIngest = input.wiring?.tradeIngestBase
+        ? {
+            client: input.wiring.tradeIngestBase.client,
+            userId: input.wiring.tradeIngestBase.userId,
+            exchange: fillExchangeId(input.venue ?? 'binance'),
+        }
+        : undefined;
     // Hyperliquid live (issue #217): mirror the boot path's construction —
     // per-venue credential shape, the SAME factory (createLiveAdapter), and
     // the same fall-back-to-paper defense when credentials are absent.
@@ -45,6 +61,8 @@ export function buildAdapter(input) {
                 credentials: input.hlCredentials,
                 mode: mode,
                 marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
+                microLive,
+                tradeIngest,
             },
         });
     }
@@ -55,7 +73,12 @@ export function buildAdapter(input) {
     // Read bracket-mode from plugin-config at adapter build time so a config
     // flip + "Reconnect Exchange" pattern picks up the new mode on the next swap.
     const bracketMode = loadBracketMode();
-    return new LiveAdapter(exchange, mode, microLive, bracketMode);
+    // Same read-at-build-time rule for the user-data stream (F9): a rebuilt
+    // adapter wires its WS at construction, so passing nothing here reverted
+    // prod's `enforce` to REST-only polling on every dashboard reconnect.
+    const userDataStreamMode = loadUserDataStreamMode();
+    const userDataStreamTunables = loadUserDataStreamTunables();
+    return new LiveAdapter(exchange, mode, microLive, bracketMode, userDataStreamMode, userDataStreamTunables, tradeIngest, input.wiring?.autoCapture);
 }
 /**
  * Mutable runtime holder. Held once per plugin registration.
@@ -82,6 +105,17 @@ export class PluginRuntime {
      *  for watcher closes (issue #199) — without it, a live<->paper reconnect
      *  would silently shed the capture wiring. */
     onWatcherCreated;
+    /** Observer applied to EVERY live adapter this runtime creates (audit F9,
+     *  same pattern as onWatcherCreated). index.ts uses it to install the
+     *  drift_detected → journal close-bypass cleanup listener — previously
+     *  installed only on the BOOT adapter and lost on every reconnect. */
+    onAdapterCreated;
+    /** Boot live wiring threaded into every buildAdapter call (audit F9). */
+    liveWiring;
+    /** Fired after EVERY reconnect publishes its adapter (paper ones included) —
+     *  set post-construction because its consumer (the approval-listener
+     *  lifecycle, audit F10) is built after the runtime. */
+    onAdapterSwapped;
     /** Reconnect is serialized — a second caller waits for the first to finish
      *  so we never tear down an adapter that's mid-rebuild. */
     reconnectInFlight = null;
@@ -93,11 +127,16 @@ export class PluginRuntime {
         this._marketFeed = initial.marketFeed ?? null;
         this.operationLock = initial.operationLock;
         this.onWatcherCreated = initial.onWatcherCreated;
+        this.onAdapterCreated = initial.onAdapterCreated;
+        this.liveWiring = initial.liveWiring;
     }
     get adapter() { return this._adapter; }
     get mode() { return this._mode; }
     get stopWatcher() { return this._stopWatcher; }
     get marketFeed() { return this._marketFeed; }
+    setOnAdapterSwapped(cb) {
+        this.onAdapterSwapped = cb;
+    }
     setWave9LiveLifecycleHooks(hooks) {
         this.wave9LiveLifecycleHooks = hooks;
         if (this._adapter instanceof LiveAdapter) {
@@ -160,7 +199,9 @@ export class PluginRuntime {
                 logger.warn(TAG, `old HL adapter stop failed: ${formatError(err)}`);
             }
         }
-        // 3. Build the new adapter.
+        // 3. Build the new adapter — with the boot live wiring, so a reconnect
+        //    can never silently shed WS authority / audit ingest / auto-capture
+        //    (audit F9).
         const fresh = buildAdapter({
             mode: next.mode,
             exchange: next.exchange,
@@ -168,12 +209,18 @@ export class PluginRuntime {
             simulator: this.simulator,
             venue: next.venue,
             hlCredentials: next.hlCredentials,
+            wiring: this.liveWiring,
         });
         // Install autonomous protection callbacks before initialization can emit
         // user-data or bracket-reconciler events.
         if (fresh instanceof LiveAdapter) {
             this.wave9LiveLifecycleHooks?.configureLiveAdapter?.(fresh);
         }
+        // Same before-init rule for the drift_detected journal cleanup (F9): the
+        // reconciler can emit on its first poll.
+        if (fresh instanceof LiveAdapter || fresh instanceof HyperliquidLiveAdapter) {
+            this.onAdapterCreated?.(fresh);
+        }
         // 4. Fire async init for live adapters (non-blocking — readiness flips
         //    INIT_PENDING → READY/DEGRADED/BLOCKED on its own).
         if (fresh instanceof LiveAdapter || fresh instanceof HyperliquidLiveAdapter) {
@@ -210,6 +257,10 @@ export class PluginRuntime {
                 this._marketFeed.start();
             }
         }
+        // 8. Notify swap observers (approval-listener lifecycle etc. — F10).
+        //    Fired for EVERY swap including paper, so a live→PAPER flip can tear
+        //    down consumers bound to the orphaned live adapter.
+        this.onAdapterSwapped?.(fresh);
         logger.info(TAG, `Reconnect complete: now in ${this._mode} mode (readiness=${fresh.readiness})`);
     }
 }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Supervised trading plugin for the ReefClaw dashboard: paper trading with real market data (no API keys required), and optional live trading on Binance or Hyperliquid behind explicit operator opt-in, exchange API credentials, and always-on protective stop brackets. Includes the dashboard connector bridge, heartbeat automation, and remote SKILL.md instruction updates from the ReefClaw webapp.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "ReefClaw supervised trading plugin for OpenClaw \u2014 paper trading with real market data, optional live trading on Binance or Hyperliquid (operator opt-in, API keys, always-on protective brackets), plus the ReefClaw dashboard connector with heartbeat automation and remote SKILL.md updates from the ReefClaw webapp. Install: /plugins install clawhub:@reefclaw/openclaw-plugin",
   "type": "module",
   "main": "index.js",
@@ -22,7 +22,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@reefclaw/shared": "0.1.2",
+    "@reefclaw/shared": "0.1.3",
     "ccxt": "4.5.37",
     "json5": "2.2.3",
     "ws": "8.19.0"

package/simulator/exchange-simulator.d.ts

@@ -4,6 +4,9 @@ import type { CcxtOrder, CcxtBalance, CcxtPosition, CcxtTicker } from '../types.
 export declare class ExchangeSimulator extends EventEmitter {
     private state;
     private lastTicker;
+    /** Symbols with a take-profit close in flight — suppresses a re-entrant
+     *  tick firing a second close on the same position. */
+    private takeProfitPending;
     private lastOrderBook;
     private simulationConfig;
     /** Metadata for pending limit orders, keyed by order ID. Cleaned up on fill/cancel. */
@@ -46,10 +49,21 @@ export declare class ExchangeSimulator extends EventEmitter {
     /** Cache the latest order book snapshot for a symbol. */
     updateOrderBook(symbol: string, orderbook: OrderBookDepth): void;
     getLastOrderBook(symbol: string): OrderBookDepth | undefined;
-    createOrder(symbol: string, side: 'buy' | 'sell', type: 'market' | 'limit', amount: number, price?: number, metadata?: PositionMetadata): CcxtOrder;
+    createOrder(symbol: string, side: 'buy' | 'sell', type: 'market' | 'limit', amount: number, price?: number, metadata?: PositionMetadata, 
+    /** Paper-only market-fill price override (take-profit leg). When set, the
+     *  market branch prices off THIS instead of the last tick, and skips the
+     *  stale-quote guard — the caller supplied the price, so quote age is
+     *  irrelevant, and a protective exit must never be blocked (issue #202). */
+    referencePrice?: number): CcxtOrder;
     cancelOrder(orderId: string): CcxtOrder;
     cancelAllOrders(symbol?: string): CcxtOrder[];
-    closePosition(symbol: string, closeReason?: CloseReason): CcxtOrder;
+    /**
+     * @param referencePrice Paper-only fill-price override. Used by the
+     *   take-profit leg to fill AT the target level instead of the (possibly
+     *   gapped-past) tick price — see `checkTakeProfitLegs`. Omitted everywhere
+     *   else, which keeps the normal market-close path byte-identical.
+     */
+    closePosition(symbol: string, closeReason?: CloseReason, referencePrice?: number): CcxtOrder;
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip
      *  (which pays an extra taker fee and resets the R/MFE denominators). The
@@ -63,6 +77,35 @@ export declare class ExchangeSimulator extends EventEmitter {
     }): void;
     updateTicker(ticker: CcxtTicker): void;
     getLastTicker(symbol: string): CcxtTicker | undefined;
+    /**
+     * Take-profit legs — the paper analog of the exchange-native
+     * `TAKE_PROFIT_MARKET` order live attaches at entry.
+     *
+     * ★ Why this exists: paper STORED `metadata.targetPrice` and surfaced it
+     * (chart line, positions table) but nothing ever closed on it, so the TP was
+     * a drawing rather than an order. Every paper winner ran straight past its
+     * exit — observed live 2026-07-27 on an OP/USDT short that reached +2.07R
+     * against a 1.0R target. That made paper the odd one out of three: the
+     * BACKTEST exits at target (`backtest/engine.ts` exitReason 'target') and
+     * LIVE exits at target (Binance TP_MARKET leg / HL coordinator TP leg), so
+     * a strategy forward-validated on paper was being measured on a book that
+     * let every winner run.
+     *
+     * Fill convention: the TARGET LEVEL is the decision price, and the normal
+     * realistic-fill engine applies its own adverse slippage around it (book
+     * VWAP + vol factor + taker fee) — the same model every other paper fill
+     * uses, rather than a second hand-rolled slippage constant. When a tick gaps
+     * past the target we deliberately do NOT credit the gap: filling at the
+     * level is worse for us than filling at the gapped tick, so this stays
+     * conservative against both the backtest and a real TP_MARKET (which would
+     * fill at the gapped price).
+     *
+     * Stops stay with the PositionWatcher: it is the safety floor and re-homing
+     * it is a separate, riskier change. A single tick can only breach one leg
+     * (stop and target sit on opposite sides of entry), so there is no
+     * stop-vs-target ordering ambiguity to resolve here.
+     */
+    private checkTakeProfitLegs;
     /** Walk every position for `symbol` and refresh MFE / give-back from the
      *  latest mark. Idempotent — pure update of `metadata.mfePeakPrice` (only
      *  ratchets favourably) plus derived `mfeR` and `giveBackRatio`. Safe to

package/simulator/exchange-simulator.js

@@ -6,7 +6,7 @@
 // via SimulationConfig and OrderBookDepth.
 import { EventEmitter } from 'node:events';
 import { randomUUID } from 'node:crypto';
-import { logger } from '../logger.js';
+import { logger, formatError } from '../logger.js';
 import { MAX_TRADE_HISTORY, DEFAULT_SIMULATION_CONFIG } from './types.js';
 import { fillMarketOrder, fillLimitOrder, parseSymbol } from './fill-engine.js';
 import { updateMfe } from '../mfe.js';
@@ -15,6 +15,9 @@ const TAG = 'simulator';
 export class ExchangeSimulator extends EventEmitter {
     state;
     lastTicker = new Map();
+    /** Symbols with a take-profit close in flight — suppresses a re-entrant
+     *  tick firing a second close on the same position. */
+    takeProfitPending = new Set();
     lastOrderBook = new Map();
     simulationConfig;
     /** Metadata for pending limit orders, keyed by order ID. Cleaned up on fill/cancel. */
@@ -247,7 +250,12 @@ export class ExchangeSimulator extends EventEmitter {
         return this.lastOrderBook.get(symbol);
     }
     // ---- Write operations (for tools) ----
-    createOrder(symbol, side, type, amount, price, metadata) {
+    createOrder(symbol, side, type, amount, price, metadata, 
+    /** Paper-only market-fill price override (take-profit leg). When set, the
+     *  market branch prices off THIS instead of the last tick, and skips the
+     *  stale-quote guard — the caller supplied the price, so quote age is
+     *  irrelevant, and a protective exit must never be blocked (issue #202). */
+    referencePrice) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
@@ -281,6 +289,10 @@ export class ExchangeSimulator extends EventEmitter {
             createdAt: now,
         };
         if (type === 'market') {
+            // Explicit fill price (take-profit leg) — see the param doc above.
+            if (referencePrice !== undefined && Number.isFinite(referencePrice) && referencePrice > 0) {
+                return this.executeMarketFill(order, referencePrice, metadata);
+            }
             // Market orders fill immediately at current price
             const ticker = this.lastTicker.get(symbol);
             if (!ticker) {
@@ -345,7 +357,13 @@ export class ExchangeSimulator extends EventEmitter {
         }
         return cancelled.map(o => this.toCcxtOrder(o));
     }
-    closePosition(symbol, closeReason) {
+    /**
+     * @param referencePrice Paper-only fill-price override. Used by the
+     *   take-profit leg to fill AT the target level instead of the (possibly
+     *   gapped-past) tick price — see `checkTakeProfitLegs`. Omitted everywhere
+     *   else, which keeps the normal market-close path byte-identical.
+     */
+    closePosition(symbol, closeReason, referencePrice) {
         const position = this.state.positions.find(p => p.symbol === symbol);
         if (!position) {
             throw new Error(`No open position for ${symbol}`);
@@ -359,7 +377,7 @@ export class ExchangeSimulator extends EventEmitter {
         }
         // Create opposing market order to close the position
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip
@@ -385,6 +403,10 @@ export class ExchangeSimulator extends EventEmitter {
     updateTicker(ticker) {
         this.lastTicker.set(ticker.symbol, ticker);
         this.refreshMfeForSymbol(ticker.symbol, ticker.last);
+        // MFE is refreshed FIRST so the peak this tick reached is recorded before a
+        // target close reads it — otherwise every TP exit would understate its own
+        // MFE and skew the capture-ratio analysis.
+        this.checkTakeProfitLegs(ticker.symbol, ticker.last);
         // Check if any pending limit orders should fill
         const toFill = [];
         const remaining = [];
@@ -429,6 +451,76 @@ export class ExchangeSimulator extends EventEmitter {
     getLastTicker(symbol) {
         return this.lastTicker.get(symbol);
     }
+    /**
+     * Take-profit legs — the paper analog of the exchange-native
+     * `TAKE_PROFIT_MARKET` order live attaches at entry.
+     *
+     * ★ Why this exists: paper STORED `metadata.targetPrice` and surfaced it
+     * (chart line, positions table) but nothing ever closed on it, so the TP was
+     * a drawing rather than an order. Every paper winner ran straight past its
+     * exit — observed live 2026-07-27 on an OP/USDT short that reached +2.07R
+     * against a 1.0R target. That made paper the odd one out of three: the
+     * BACKTEST exits at target (`backtest/engine.ts` exitReason 'target') and
+     * LIVE exits at target (Binance TP_MARKET leg / HL coordinator TP leg), so
+     * a strategy forward-validated on paper was being measured on a book that
+     * let every winner run.
+     *
+     * Fill convention: the TARGET LEVEL is the decision price, and the normal
+     * realistic-fill engine applies its own adverse slippage around it (book
+     * VWAP + vol factor + taker fee) — the same model every other paper fill
+     * uses, rather than a second hand-rolled slippage constant. When a tick gaps
+     * past the target we deliberately do NOT credit the gap: filling at the
+     * level is worse for us than filling at the gapped tick, so this stays
+     * conservative against both the backtest and a real TP_MARKET (which would
+     * fill at the gapped price).
+     *
+     * Stops stay with the PositionWatcher: it is the safety floor and re-homing
+     * it is a separate, riskier change. A single tick can only breach one leg
+     * (stop and target sit on opposite sides of entry), so there is no
+     * stop-vs-target ordering ambiguity to resolve here.
+     */
+    checkTakeProfitLegs(symbol, price) {
+        if (!Number.isFinite(price) || price <= 0)
+            return;
+        // Snapshot: closing mutates state.positions mid-iteration.
+        const candidates = this.state.positions.filter((p) => p.symbol === symbol);
+        for (const position of candidates) {
+            const target = position.metadata?.targetPrice;
+            if (target === undefined || !Number.isFinite(target) || target <= 0)
+                continue;
+            const breached = position.side === 'long' ? price >= target : price <= target;
+            if (!breached)
+                continue;
+            // Guard against a re-entrant tick firing a second close on the same
+            // symbol while the first is still settling.
+            if (this.takeProfitPending.has(symbol))
+                continue;
+            this.takeProfitPending.add(symbol);
+            try {
+                logger.info(TAG, `TARGET REACHED: ${symbol} ${position.side} price=${price} target=${target} — closing (exchange_target)`);
+                // Target = decision price; the fill engine adds realistic adverse
+                // slippage on top (see the fill-convention note above).
+                const order = this.closePosition(symbol, 'exchange_target', target);
+                this.emit('target_closed', {
+                    symbol,
+                    side: position.side,
+                    targetPrice: target,
+                    markPrice: price,
+                    fillPrice: typeof order.average === 'number' ? order.average : target,
+                    quantity: position.quantity,
+                    order,
+                });
+            }
+            catch (err) {
+                // Never let a failed protective close kill the tick loop — the next
+                // tick retries, and the position is still visible to the agent.
+                logger.error(TAG, `Target close failed for ${symbol}: ${formatError(err)}`);
+            }
+            finally {
+                this.takeProfitPending.delete(symbol);
+            }
+        }
+    }
     /** Walk every position for `symbol` and refresh MFE / give-back from the
      *  latest mark. Idempotent — pure update of `metadata.mfePeakPrice` (only
      *  ratchets favourably) plus derived `mfeR` and `giveBackRatio`. Safe to

package/simulator/types.d.ts

@@ -1,3 +1,4 @@
+import type { CcxtOrder } from '../types.js';
 export interface FillError {
     orderId: string;
     symbol: string;
@@ -76,6 +77,22 @@ export interface ExecutionStats {
 export interface Wallet {
     [currency: string]: CurrencyBalance;
 }
+/** Emitted when the paper take-profit leg fires (`ExchangeSimulator`
+ *  'target_closed'). The live analog is an exchange-native TAKE_PROFIT_MARKET
+ *  fill; index.ts journals this the same way it journals a stop-watcher close,
+ *  so a target exit can never leave a phantom-open journal row (issue #199). */
+export interface TargetClosedEvent {
+    symbol: string;
+    side: 'long' | 'short';
+    /** The pinned target level that was breached. */
+    targetPrice: number;
+    /** The tick price that breached it (may have gapped past the target). */
+    markPrice: number;
+    /** Where we actually filled — the target level with adverse slippage. */
+    fillPrice: number;
+    quantity: number;
+    order: CcxtOrder;
+}
 export interface CurrencyBalance {
     total: number;
     available: number;

package/tools/attach-brackets.js

@@ -323,13 +323,28 @@ async function attachBracketsHl(args, adapter) {
     let clearedStaleLedgerRow = false;
     if (existing && !isTerminalBracketState(existing.state)) {
         let cls = 'unknown';
+        // Per-LEG liveness (audit 2026-07-26 F4): "either cid survives ⇒ live"
+        // let a TP-only position no-op as "already protected" indefinitely while
+        // its stop was gone. A registered leg positively absent from a NON-EMPTY
+        // order set is a protection gap this tool must repair, not paper over.
+        const missingLegs = [];
         const hasCids = Boolean(existing.slCid || existing.tpCid);
         if (hasCids) {
             try {
                 const open = await adapter.getOpenOrders(position.symbol);
                 const liveCids = new Set(open.map(o => o.clientOrderId).filter(Boolean));
-                if ((existing.slCid && liveCids.has(existing.slCid)) || (existing.tpCid && liveCids.has(existing.tpCid))) {
+                const stopLive = Boolean(existing.slCid && liveCids.has(existing.slCid));
+                const tpLive = Boolean(existing.tpCid && liveCids.has(existing.tpCid));
+                if (stopLive || tpLive) {
                     cls = 'live';
+                    if (open.length > 0) {
+                        // Non-empty set = positive evidence for absence (d59e51b) — a
+                        // registered-but-absent sibling is a repairable gap.
+                        if (existing.slCid && !stopLive)
+                            missingLegs.push('stop');
+                        if (existing.tpCid && !tpLive)
+                            missingLegs.push('target');
+                    }
                 }
                 else if (open.length > 0) {
                     cls = 'stale'; // non-empty set positively lacking our cids
@@ -351,6 +366,40 @@ async function attachBracketsHl(args, adapter) {
         if (cls === 'live') {
             if (pricesMatch(args.stop_price, existing.stopPrice)
                 && pricesMatch(args.target_price, existing.targetPrice)) {
+                if (missingLegs.length > 0) {
+                    // One registered leg is positively gone (a stop-less position is a
+                    // safety-floor breach). Rebuild it at the registered price via the
+                    // resize path — planResize submits ONLY the missing leg and leaves
+                    // the healthy sibling untouched (F4).
+                    try {
+                        const coordinator = adapter.getHlBracketCoordinator();
+                        await coordinator.resizeToPosition(position.symbol, contracts);
+                        const healed = ledger.getBySymbol(position.symbol);
+                        return {
+                            ok: true,
+                            symbol: position.symbol,
+                            bracket_id: existing.bracketId,
+                            entry_side: entrySide,
+                            stop_price: existing.stopPrice,
+                            target_price: existing.targetPrice,
+                            sl_cid: healed?.slCid ?? existing.slCid,
+                            tp_cid: healed?.tpCid ?? existing.tpCid,
+                            attach_latency_ms: 0,
+                            cancelled_stale_bracket_orders: 0,
+                            cleared_stale_ledger_row: false,
+                            attempts: 1,
+                            idempotent_no_op: false,
+                            note: `Missing ${missingLegs.join('+')} leg re-attached at the registered price(s); sibling leg untouched.`,
+                        };
+                    }
+                    catch (err) {
+                        return {
+                            error: `Registered ${missingLegs.join('+')} leg is GONE from the exchange and the rebuild ` +
+                                `failed (${formatError(err)}). The position is under-protected — retry attach_brackets ` +
+                                `next heartbeat; the 60s truth sweep also retries. Do NOT record a protected review.`,
+                        };
+                    }
+                }
                 return {
                     ok: true,
                     symbol: position.symbol,

package/venues/hyperliquid/hl-bracket-coordinator.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { CcxtOrder, CcxtPosition } from '../../types.js';
 import type { CloseReason } from '../../simulator/types.js';
-import type { BracketId, BracketRequest, BracketState } from '../../live/bracket-types.js';
+import type { BracketId, BracketLedgerEntry, BracketRequest, BracketState } from '../../live/bracket-types.js';
 import type { BracketLedger } from '../../live/bracket-ledger.js';
 import type { HlOrderUpdateEvent } from './hl-user-stream.js';
 /** Narrow execution surface the coordinator needs — the HyperliquidLiveAdapter
@@ -24,6 +24,11 @@ export interface HlBracketExecutor {
         symbol: string;
         positionSide: 'long' | 'short';
         positionSize: number;
+        /** Ledger-registered prices — lets resize REBUILD a vanished leg (F4). */
+        registeredPrices?: {
+            stop?: number;
+            target?: number;
+        };
     }): Promise<{
         resized: boolean;
         slCid?: string;
@@ -88,6 +93,25 @@ export declare class HlBracketCoordinator extends EventEmitter {
      *  fill signal against a non-terminal row is a warned NO-OP, never a fresh
      *  bracketId that orphans the live legs' ledger identity. */
     registerEntry(req: BracketRequest, bracketId: BracketId, entryCid: string): void;
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol: string, entryCid: string): void;
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid: string | undefined | null): BracketLedgerEntry | undefined;
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */