@reefclaw/openclaw-plugin 0.1.13 → 0.1.15

package/simulator/exchange-simulator.js

@@ -6,7 +6,7 @@
 // via SimulationConfig and OrderBookDepth.
 import { EventEmitter } from 'node:events';
 import { randomUUID } from 'node:crypto';
-import { logger } from '../logger.js';
+import { logger, formatError } from '../logger.js';
 import { MAX_TRADE_HISTORY, DEFAULT_SIMULATION_CONFIG } from './types.js';
 import { fillMarketOrder, fillLimitOrder, parseSymbol } from './fill-engine.js';
 import { updateMfe } from '../mfe.js';
@@ -15,6 +15,9 @@ const TAG = 'simulator';
 export class ExchangeSimulator extends EventEmitter {
     state;
     lastTicker = new Map();
+    /** Symbols with a take-profit close in flight — suppresses a re-entrant
+     *  tick firing a second close on the same position. */
+    takeProfitPending = new Set();
     lastOrderBook = new Map();
     simulationConfig;
     /** Metadata for pending limit orders, keyed by order ID. Cleaned up on fill/cancel. */
@@ -247,7 +250,12 @@ export class ExchangeSimulator extends EventEmitter {
         return this.lastOrderBook.get(symbol);
     }
     // ---- Write operations (for tools) ----
-    createOrder(symbol, side, type, amount, price, metadata) {
+    createOrder(symbol, side, type, amount, price, metadata, 
+    /** Paper-only market-fill price override (take-profit leg). When set, the
+     *  market branch prices off THIS instead of the last tick, and skips the
+     *  stale-quote guard — the caller supplied the price, so quote age is
+     *  irrelevant, and a protective exit must never be blocked (issue #202). */
+    referencePrice) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
@@ -281,6 +289,10 @@ export class ExchangeSimulator extends EventEmitter {
             createdAt: now,
         };
         if (type === 'market') {
+            // Explicit fill price (take-profit leg) — see the param doc above.
+            if (referencePrice !== undefined && Number.isFinite(referencePrice) && referencePrice > 0) {
+                return this.executeMarketFill(order, referencePrice, metadata);
+            }
             // Market orders fill immediately at current price
             const ticker = this.lastTicker.get(symbol);
             if (!ticker) {
@@ -345,7 +357,13 @@ export class ExchangeSimulator extends EventEmitter {
         }
         return cancelled.map(o => this.toCcxtOrder(o));
     }
-    closePosition(symbol, closeReason) {
+    /**
+     * @param referencePrice Paper-only fill-price override. Used by the
+     *   take-profit leg to fill AT the target level instead of the (possibly
+     *   gapped-past) tick price — see `checkTakeProfitLegs`. Omitted everywhere
+     *   else, which keeps the normal market-close path byte-identical.
+     */
+    closePosition(symbol, closeReason, referencePrice) {
         const position = this.state.positions.find(p => p.symbol === symbol);
         if (!position) {
             throw new Error(`No open position for ${symbol}`);
@@ -359,7 +377,7 @@ export class ExchangeSimulator extends EventEmitter {
         }
         // Create opposing market order to close the position
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip
@@ -385,6 +403,10 @@ export class ExchangeSimulator extends EventEmitter {
     updateTicker(ticker) {
         this.lastTicker.set(ticker.symbol, ticker);
         this.refreshMfeForSymbol(ticker.symbol, ticker.last);
+        // MFE is refreshed FIRST so the peak this tick reached is recorded before a
+        // target close reads it — otherwise every TP exit would understate its own
+        // MFE and skew the capture-ratio analysis.
+        this.checkTakeProfitLegs(ticker.symbol, ticker.last);
         // Check if any pending limit orders should fill
         const toFill = [];
         const remaining = [];
@@ -429,6 +451,76 @@ export class ExchangeSimulator extends EventEmitter {
     getLastTicker(symbol) {
         return this.lastTicker.get(symbol);
     }
+    /**
+     * Take-profit legs — the paper analog of the exchange-native
+     * `TAKE_PROFIT_MARKET` order live attaches at entry.
+     *
+     * ★ Why this exists: paper STORED `metadata.targetPrice` and surfaced it
+     * (chart line, positions table) but nothing ever closed on it, so the TP was
+     * a drawing rather than an order. Every paper winner ran straight past its
+     * exit — observed live 2026-07-27 on an OP/USDT short that reached +2.07R
+     * against a 1.0R target. That made paper the odd one out of three: the
+     * BACKTEST exits at target (`backtest/engine.ts` exitReason 'target') and
+     * LIVE exits at target (Binance TP_MARKET leg / HL coordinator TP leg), so
+     * a strategy forward-validated on paper was being measured on a book that
+     * let every winner run.
+     *
+     * Fill convention: the TARGET LEVEL is the decision price, and the normal
+     * realistic-fill engine applies its own adverse slippage around it (book
+     * VWAP + vol factor + taker fee) — the same model every other paper fill
+     * uses, rather than a second hand-rolled slippage constant. When a tick gaps
+     * past the target we deliberately do NOT credit the gap: filling at the
+     * level is worse for us than filling at the gapped tick, so this stays
+     * conservative against both the backtest and a real TP_MARKET (which would
+     * fill at the gapped price).
+     *
+     * Stops stay with the PositionWatcher: it is the safety floor and re-homing
+     * it is a separate, riskier change. A single tick can only breach one leg
+     * (stop and target sit on opposite sides of entry), so there is no
+     * stop-vs-target ordering ambiguity to resolve here.
+     */
+    checkTakeProfitLegs(symbol, price) {
+        if (!Number.isFinite(price) || price <= 0)
+            return;
+        // Snapshot: closing mutates state.positions mid-iteration.
+        const candidates = this.state.positions.filter((p) => p.symbol === symbol);
+        for (const position of candidates) {
+            const target = position.metadata?.targetPrice;
+            if (target === undefined || !Number.isFinite(target) || target <= 0)
+                continue;
+            const breached = position.side === 'long' ? price >= target : price <= target;
+            if (!breached)
+                continue;
+            // Guard against a re-entrant tick firing a second close on the same
+            // symbol while the first is still settling.
+            if (this.takeProfitPending.has(symbol))
+                continue;
+            this.takeProfitPending.add(symbol);
+            try {
+                logger.info(TAG, `TARGET REACHED: ${symbol} ${position.side} price=${price} target=${target} — closing (exchange_target)`);
+                // Target = decision price; the fill engine adds realistic adverse
+                // slippage on top (see the fill-convention note above).
+                const order = this.closePosition(symbol, 'exchange_target', target);
+                this.emit('target_closed', {
+                    symbol,
+                    side: position.side,
+                    targetPrice: target,
+                    markPrice: price,
+                    fillPrice: typeof order.average === 'number' ? order.average : target,
+                    quantity: position.quantity,
+                    order,
+                });
+            }
+            catch (err) {
+                // Never let a failed protective close kill the tick loop — the next
+                // tick retries, and the position is still visible to the agent.
+                logger.error(TAG, `Target close failed for ${symbol}: ${formatError(err)}`);
+            }
+            finally {
+                this.takeProfitPending.delete(symbol);
+            }
+        }
+    }
     /** Walk every position for `symbol` and refresh MFE / give-back from the
      *  latest mark. Idempotent — pure update of `metadata.mfePeakPrice` (only
      *  ratchets favourably) plus derived `mfeR` and `giveBackRatio`. Safe to

package/simulator/types.d.ts

@@ -1,3 +1,4 @@
+import type { CcxtOrder } from '../types.js';
 export interface FillError {
     orderId: string;
     symbol: string;
@@ -76,6 +77,22 @@ export interface ExecutionStats {
 export interface Wallet {
     [currency: string]: CurrencyBalance;
 }
+/** Emitted when the paper take-profit leg fires (`ExchangeSimulator`
+ *  'target_closed'). The live analog is an exchange-native TAKE_PROFIT_MARKET
+ *  fill; index.ts journals this the same way it journals a stop-watcher close,
+ *  so a target exit can never leave a phantom-open journal row (issue #199). */
+export interface TargetClosedEvent {
+    symbol: string;
+    side: 'long' | 'short';
+    /** The pinned target level that was breached. */
+    targetPrice: number;
+    /** The tick price that breached it (may have gapped past the target). */
+    markPrice: number;
+    /** Where we actually filled — the target level with adverse slippage. */
+    fillPrice: number;
+    quantity: number;
+    order: CcxtOrder;
+}
 export interface CurrencyBalance {
     total: number;
     available: number;

package/skills/reefclaw/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reefclaw
-version: 0.0.6
+version: 0.0.7
 description: ReefClaw trading control room — bootstrap (connects your agent; full trading instructions arrive automatically after first connect)
 author: ReefClaw
 homepage: https://reefclaw.com
@@ -24,18 +24,13 @@ config:
     description: ReefClaw relay WebSocket URL. Defaults to the production relay when omitted.
 ---
 
-<!-- BOOTSTRAP SKILL.md — this is the thin installer copy shipped in the
-     @reefclaw/connect npm package. It carries ONLY the config schema and the
-     connect instructions. The FULL trading instructions (versioned 2.x.y) are
-     delivered automatically by the ReefClaw connector minutes after the first
-     successful connect, over the authenticated update channel — they replace
-     this file in place (a 0.0.x version always loses the semver comparison).
-     The "Connecting (first run)" section below MUST stay in sync with the
-     same section in skill/SKILL.md. -->
-
 # ReefClaw — Connect Your Agent (Bootstrap)
 
-You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard. This bootstrap file only covers **connecting**; your full trading instructions arrive automatically a few minutes after the connection succeeds.
+## About this file
+
+This is the thin BOOTSTRAP copy shipped in the `@reefclaw/connect` npm package. It covers **installing the ReefClaw plugin and connecting to the user's ReefClaw account** — nothing else. The FULL trading instructions (versioned 2.x.y) are delivered automatically by the ReefClaw connector minutes after the first successful connect, over the authenticated update channel — they replace this file in place (a 0.0.x version always loses the semver comparison). Maintainers: the "Connecting (first run)" section below MUST stay in sync with the same section in `skill/SKILL.md`.
+
+You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard. Some steps below change host configuration or install software; they exist solely to complete the setup **the user initiated by pasting their connect message**. Tell the user what each step changes before you do it, do it only for that user, and revert any temporary permission (like elevated exec) as soon as the install completes.
 
 **Do not attempt to trade before the full instructions arrive.** If trading tools are visible but this file is still a bootstrap version (0.0.x), the connection has not completed — finish connecting first.
 

package/strategy/condition-registry.js

@@ -36,20 +36,27 @@ register('oi_slope', (fact) => ({
     name: 'oi_slope',
     met: fact.conditions.oi_slope_up ?? false,
 }));
-// 5. no_liquidation_cluster — always passes in scan context (no live data)
+// 5. no_liquidation_cluster — FAIL-OPEN PLACEHOLDER in scan context: the
+// fact-computer ships no liquidation data, so this preview cannot evaluate
+// it. `note` marks the gap explicitly (never a silent pass); the
+// authoritative evaluation runs in the central signal engine, which reads the
+// live liquidation-levels feed.
 register('no_liquidation_cluster', () => ({
     name: 'no_liquidation_cluster',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 6. price_sweep
 register('price_sweep', (fact) => ({
     name: 'price_sweep',
     met: (fact.conditions.price_sweep_high ?? false) || (fact.conditions.price_sweep_low ?? false),
 }));
-// 7. liquidations_at_sweep — always passes in scan context
+// 7. liquidations_at_sweep — FAIL-OPEN PLACEHOLDER in scan context, same gap
+// and same note contract as no_liquidation_cluster above.
 register('liquidations_at_sweep', () => ({
     name: 'liquidations_at_sweep',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 8. order_flow_absorption
 register('order_flow_absorption', (fact) => ({

package/strategy/evaluator.d.ts

@@ -45,6 +45,11 @@ export interface ConditionEvalResult {
     name: string;
     met: boolean;
     value?: number;
+    /** Set when `met` is a fail-open placeholder rather than a real evaluation
+     *  (e.g. the scan facts carry no data for this condition). Surfaces the gap
+     *  to any consumer instead of letting a pass silently impersonate a check —
+     *  the authoritative evaluation runs in the central signal engine. */
+    note?: string;
 }
 export interface StrategyEvalResult {
     strategy: string;

package/tools/attach-brackets.js

@@ -323,13 +323,28 @@ async function attachBracketsHl(args, adapter) {
     let clearedStaleLedgerRow = false;
     if (existing && !isTerminalBracketState(existing.state)) {
         let cls = 'unknown';
+        // Per-LEG liveness (audit 2026-07-26 F4): "either cid survives ⇒ live"
+        // let a TP-only position no-op as "already protected" indefinitely while
+        // its stop was gone. A registered leg positively absent from a NON-EMPTY
+        // order set is a protection gap this tool must repair, not paper over.
+        const missingLegs = [];
         const hasCids = Boolean(existing.slCid || existing.tpCid);
         if (hasCids) {
             try {
                 const open = await adapter.getOpenOrders(position.symbol);
                 const liveCids = new Set(open.map(o => o.clientOrderId).filter(Boolean));
-                if ((existing.slCid && liveCids.has(existing.slCid)) || (existing.tpCid && liveCids.has(existing.tpCid))) {
+                const stopLive = Boolean(existing.slCid && liveCids.has(existing.slCid));
+                const tpLive = Boolean(existing.tpCid && liveCids.has(existing.tpCid));
+                if (stopLive || tpLive) {
                     cls = 'live';
+                    if (open.length > 0) {
+                        // Non-empty set = positive evidence for absence (d59e51b) — a
+                        // registered-but-absent sibling is a repairable gap.
+                        if (existing.slCid && !stopLive)
+                            missingLegs.push('stop');
+                        if (existing.tpCid && !tpLive)
+                            missingLegs.push('target');
+                    }
                 }
                 else if (open.length > 0) {
                     cls = 'stale'; // non-empty set positively lacking our cids
@@ -351,6 +366,40 @@ async function attachBracketsHl(args, adapter) {
         if (cls === 'live') {
             if (pricesMatch(args.stop_price, existing.stopPrice)
                 && pricesMatch(args.target_price, existing.targetPrice)) {
+                if (missingLegs.length > 0) {
+                    // One registered leg is positively gone (a stop-less position is a
+                    // safety-floor breach). Rebuild it at the registered price via the
+                    // resize path — planResize submits ONLY the missing leg and leaves
+                    // the healthy sibling untouched (F4).
+                    try {
+                        const coordinator = adapter.getHlBracketCoordinator();
+                        await coordinator.resizeToPosition(position.symbol, contracts);
+                        const healed = ledger.getBySymbol(position.symbol);
+                        return {
+                            ok: true,
+                            symbol: position.symbol,
+                            bracket_id: existing.bracketId,
+                            entry_side: entrySide,
+                            stop_price: existing.stopPrice,
+                            target_price: existing.targetPrice,
+                            sl_cid: healed?.slCid ?? existing.slCid,
+                            tp_cid: healed?.tpCid ?? existing.tpCid,
+                            attach_latency_ms: 0,
+                            cancelled_stale_bracket_orders: 0,
+                            cleared_stale_ledger_row: false,
+                            attempts: 1,
+                            idempotent_no_op: false,
+                            note: `Missing ${missingLegs.join('+')} leg re-attached at the registered price(s); sibling leg untouched.`,
+                        };
+                    }
+                    catch (err) {
+                        return {
+                            error: `Registered ${missingLegs.join('+')} leg is GONE from the exchange and the rebuild ` +
+                                `failed (${formatError(err)}). The position is under-protected — retry attach_brackets ` +
+                                `next heartbeat; the 60s truth sweep also retries. Do NOT record a protected review.`,
+                        };
+                    }
+                }
                 return {
                     ok: true,
                     symbol: position.symbol,

package/tools/cancel-all-orders.js

@@ -1,5 +1,13 @@
 // Tool: cancel_all_orders — cancel all open orders (paper or live)
-// NO readiness gate — emergency control (kill switch), must always work.
+//
+// NO readiness gate and NO confirmation prompt — BY DESIGN, not an oversight:
+// this is the safety floor's kill-switch primitive ("Hard controls NEVER
+// disabled or hidden"). Any gate added here becomes a failure mode of the
+// emergency path itself — a wedged confirmation would strand live orders
+// during the exact incident the kill switch exists for. Risk-reducing only:
+// it cancels WORKING orders; the adapter layer preserves protective bracket
+// legs (parseBracketCid skip in cancelAllOrders) so positions are never left
+// naked, and it never opens or increases exposure.
 export async function cancelAllOrdersTool(args, deps) {
     const cancel = () => deps.adapter.cancelAllOrders(args.symbol);
     return deps.adapter.isLive && deps.operationLock

package/tools/create-order.js

@@ -1008,11 +1008,28 @@ export async function createOrderTool(args, deps) {
         }
         // Bracket enforcement only applies in live mode when the feature is enabled.
         // Paper mode uses the stop-watcher and doesn't care about these flags.
+        //
+        // ★ `brackets.mode` is a BINANCE-only knob — it is only ever passed to
+        // LiveAdapter, and it defaults to 'off'. Gating solely on it meant an HL
+        // live rig skipped the mandatory-stop check entirely: a stopless entry
+        // passed the gate, and HL only attaches legs when stop/target metadata is
+        // present (`wireBracketsAfterSubmit`), so the position went on the book
+        // NAKED. Venues that always enforce brackets declare it on the adapter.
         let bracketEnforcement;
-        if (deps.adapter.isLive && bracketsEnabled(loadBracketMode())) {
+        if (deps.adapter.isLive && (deps.adapter.bracketsAlwaysEnforced || bracketsEnabled(loadBracketMode()))) {
             bracketEnforcement = wave9Claimed
                 ? { requireStopLoss: true, requireTakeProfit: false }
                 : loadBracketRequirements();
+            // On a venue-enforced adapter the stop requirement is NOT operator-
+            // waivable: `requireStopLoss: false` in plugin-config is a Binance-era
+            // toggle whose documented risk assumed a watcher fallback existed. HL has
+            // none — a waved-through stopless entry would sit naked. This also keeps
+            // the gate consistent with get_bracket_config, which reports
+            // requireStopLoss=true for venue-enforced adapters. The TP flag stays
+            // operator-controlled (stop-only "let winners run" is legitimate).
+            if (deps.adapter.bracketsAlwaysEnforced) {
+                bracketEnforcement = { ...bracketEnforcement, requireStopLoss: true };
+            }
         }
         const riskCheck = preTradeRiskCheck(proposed, portfolio, getDefaultPreTradeLimits(), {
             volFactor: !deps.adapter.isLive ? deps.adapter.getSimulator().getVolFactor() : 1.0,

package/tools/get-bracket-config.d.ts

@@ -3,9 +3,28 @@ export interface GetBracketConfigResult {
     mode: BracketMode;
     requireStopLoss: boolean;
     requireTakeProfit: boolean;
+    /** True when the mode reported above is the VENUE's unconditional
+     *  enforcement rather than the `brackets.mode` config value. Lets the
+     *  dashboard explain why the toggles are inert. */
+    venueEnforced?: boolean;
 }
-export declare function getBracketConfigTool(_args: Record<string, never>, deps?: {
+export interface GetBracketConfigDeps {
     configPath?: string;
-}): GetBracketConfigResult | {
+    /** Active adapter. Its `bracketsAlwaysEnforced` capability overrides the
+     *  config-file mode — see below. */
+    adapter?: {
+        readonly bracketsAlwaysEnforced?: boolean;
+    };
+}
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
+export declare function getBracketConfigTool(_args: Record<string, never>, deps?: GetBracketConfigDeps): GetBracketConfigResult | {
     error: string;
 };

package/tools/get-bracket-config.js

@@ -6,13 +6,29 @@
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { getBracketMode, getBracketRequirements } from '../config/brackets-config.js';
 import { formatError } from '../logger.js';
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
 export function getBracketConfigTool(_args, deps) {
     try {
         const cfg = readPluginConfig(deps?.configPath);
-        const mode = getBracketMode(cfg);
         const req = getBracketRequirements(cfg);
+        if (deps?.adapter?.bracketsAlwaysEnforced) {
+            return {
+                mode: 'enforce',
+                requireStopLoss: true,
+                requireTakeProfit: req.requireTakeProfit,
+                venueEnforced: true,
+            };
+        }
         return {
-            mode,
+            mode: getBracketMode(cfg),
             requireStopLoss: req.requireStopLoss,
             requireTakeProfit: req.requireTakeProfit,
         };

package/tools/set-trading-mode.js

@@ -4,9 +4,12 @@
 // the one-rung-at-a-time ladder. Requires valid exchange credentials for
 // any non-PAPER target. Rebuilds the adapter via runtime.reconnect().
 //
-// The agent should NOT call this tool; PR2 will enforce operator-only scope
-// in the skill. PR1 leaves the plugin-side handler functional but unguarded
-// because the caller chain is currently controlled end-to-end by the skill.
+// GUARDED at the dispatch site (plugin/src/index.ts registration): every call
+// must carry the `operator_token` provenance proof and is refused by
+// verifyOperatorProvenance without it (audit 2026-07-26 F12). The agent cannot
+// supply that token — chat redaction strips rc_* tokens — so only the
+// dashboard operator path reaches this handler. This module stays guard-free
+// by design: the check lives once, at registration, for all operator tools.
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { validateModeTransition, modeRequiresCredentials } from '../onboarding/mode-ladder.js';
 import { parseVenue } from '../venues/registry.js';

package/venues/hyperliquid/hl-bracket-coordinator.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { CcxtOrder, CcxtPosition } from '../../types.js';
 import type { CloseReason } from '../../simulator/types.js';
-import type { BracketId, BracketRequest, BracketState } from '../../live/bracket-types.js';
+import type { BracketId, BracketLedgerEntry, BracketRequest, BracketState } from '../../live/bracket-types.js';
 import type { BracketLedger } from '../../live/bracket-ledger.js';
 import type { HlOrderUpdateEvent } from './hl-user-stream.js';
 /** Narrow execution surface the coordinator needs — the HyperliquidLiveAdapter
@@ -24,6 +24,11 @@ export interface HlBracketExecutor {
         symbol: string;
         positionSide: 'long' | 'short';
         positionSize: number;
+        /** Ledger-registered prices — lets resize REBUILD a vanished leg (F4). */
+        registeredPrices?: {
+            stop?: number;
+            target?: number;
+        };
     }): Promise<{
         resized: boolean;
         slCid?: string;
@@ -88,6 +93,25 @@ export declare class HlBracketCoordinator extends EventEmitter {
      *  fill signal against a non-terminal row is a warned NO-OP, never a fresh
      *  bracketId that orphans the live legs' ledger identity. */
     registerEntry(req: BracketRequest, bracketId: BracketId, entryCid: string): void;
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol: string, entryCid: string): void;
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid: string | undefined | null): BracketLedgerEntry | undefined;
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */

package/venues/hyperliquid/hl-bracket-coordinator.js

@@ -32,6 +32,10 @@ import { parseHlBracketCloid } from './hl-cloid.js';
 const TAG = 'hl-bracket-coordinator';
 const DEFAULT_MAX_ATTEMPTS = 3;
 const DEFAULT_BACKOFF = (attempt) => (attempt === 1 ? 1_000 : 2_000);
+/** Cap on `extraEntryCids` so a position scaled many times cannot grow its
+ *  ledger row without bound. Oldest dropped — a cid that old has either filled
+ *  (row already resized) or been cancelled. */
+const MAX_EXTRA_ENTRY_CIDS = 20;
 const TERMINAL_STATES = new Set([
     'triggered_sl',
     'triggered_tp',
@@ -109,6 +113,12 @@ export class HlBracketCoordinator extends EventEmitter {
             logger.warn(TAG, `registerEntry(${req.symbol}): non-terminal row exists (state=${existing.state}, ` +
                 `bracketId=${existing.bracketId}) — duplicate fill signal, NOT clobbering ` +
                 `(anti-clobber contract; scale-ins go through resizeToPosition)`);
+            // ★ F5: not clobbering the row is right — DROPPING the new order's cloid
+            // was not. A duplicate signal carrying a DIFFERENT cid is a second order
+            // against the same position (a resting scale-in, or a second entry while
+            // the first is still pending); its fill has to find this row or nothing
+            // attaches/resizes for it.
+            this.registerAdditionalEntryCid(req.symbol, entryCid);
             return;
         }
         if (existing)
@@ -129,6 +139,49 @@ export class HlBracketCoordinator extends EventEmitter {
             ts: new Date(this.now()).toISOString(),
         });
     }
+    /** ★ Audit 2026-07-26 F5 — track a SECOND entry order placed against a live
+     *  bracket row (a scale-in, or another entry while the first still rests).
+     *
+     *  Each submission gets a fresh cloid, but the row keeps the ORIGINAL
+     *  `entryCid`. The user-stream fill handler matches fills to rows by cid, so
+     *  an unrecorded cid meant the later fill matched NOTHING: no attach, no
+     *  resize. On HL that is naked exposure, not cosmetic drift — legs are FIXED
+     *  SIZE (T-2), so the added contracts stayed unprotected until the 60s
+     *  truth-check sweep happened to catch them.
+     *
+     *  Idempotent; a terminal/absent row or a repeat of the primary cid is a
+     *  no-op. Recording is deliberately CHEAP and local — the sweep remains the
+     *  backstop, this just stops it being the only line of defence. */
+    registerAdditionalEntryCid(symbol, entryCid) {
+        if (!entryCid)
+            return;
+        const row = this.ledger.getBySymbol(symbol);
+        if (!row || isTerminalBracketState(row.state))
+            return;
+        if (row.entryCid === entryCid)
+            return;
+        const current = row.extraEntryCids ?? [];
+        if (current.includes(entryCid))
+            return;
+        this.ledger.upsert({
+            ...row,
+            extraEntryCids: [...current, entryCid].slice(-MAX_EXTRA_ENTRY_CIDS),
+        });
+        logger.info(TAG, `${row.symbol}: tracking additional entry cid ${entryCid} against bracket ` +
+            `${row.bracketId} (state=${row.state}) — its fill must drive attach/resize (T-2)`);
+    }
+    /** The bracket row a user-stream fill belongs to: the primary `entryCid` OR
+     *  any cid recorded by `registerAdditionalEntryCid`. Terminal rows never
+     *  match. Single home for the matching rule so the adapter's fill handler
+     *  and the ledger can never disagree about what "our entry" means. */
+    findRowByEntryCid(cloid) {
+        if (!cloid)
+            return undefined;
+        return this.ledger
+            .getAll()
+            .find((r) => !isTerminalBracketState(r.state) &&
+            (r.entryCid === cloid || r.extraEntryCids?.includes(cloid) === true));
+    }
     /** Attach both legs (ONE batched signed action) with retries. Idempotent on
      *  a non-pending row. On exhaustion: ledger 'failed' + attach_failed event —
      *  the ADAPTER escalates to auto-flatten (it owns closePosition). */
@@ -261,6 +314,10 @@ export class HlBracketCoordinator extends EventEmitter {
             symbol: entry.symbol,
             positionSide,
             positionSize: newPositionSize,
+            // F4: with the registered prices in hand, resize can REBUILD a leg that
+            // vanished entirely (e.g. a stripped stop) instead of no-oping while
+            // the coverage sweep warns forever.
+            registeredPrices: { stop: entry.stopPrice, target: entry.targetPrice },
         });
         if (res.resized) {
             this.ledger.markState(symbol, entry.state, {

package/venues/hyperliquid/hl-brackets.d.ts

@@ -87,6 +87,16 @@ export declare function planResize(args: {
     positionSide: 'long' | 'short';
     positionSize: number;
     liveLegs: LiveLeg[];
+    /** The prices REGISTERED at attach (the ledger row's stopPrice/targetPrice).
+     *  ★ Audit 2026-07-26 F4: a role whose leg vanished entirely used to be
+     *  "the attach path's job" — but no path owned it, so a stop-less position
+     *  never self-healed. With the registered price in hand, resize REBUILDS
+     *  the missing leg at the price the agent pinned; without one it cannot
+     *  invent a level and leaves the role to the coverage alarms. */
+    registeredPrices?: {
+        stop?: number;
+        target?: number;
+    };
 }): ResizePlan;
 /** Is this exchange order one of OUR protective legs?
  *