@reefclaw/openclaw-plugin 0.1.24 → 0.1.25

package/portfolio/reentry-tracker.d.ts

@@ -4,8 +4,24 @@ export interface ReentryExitRecord {
     /** setup_type / strategy name from the entry metadata, when known. */
     setupType?: string;
     side: 'long' | 'short';
-    /** Whether the closed trade realized a loss (drives the stronger caution). */
+    /** Whether the closed trade realized a loss (drives the stronger caution
+     *  and arms the reentryCooldown gate). */
     wasLoss?: boolean;
+    /** Where the wasLoss sign came from, for auditing sign-accuracy before the
+     *  cooldown gate is promoted past shadow: engine-exact ('paper_engine',
+     *  'ws_fill') vs the agent's own close assessment ('assessment_r'). */
+    lossSource?: 'paper_engine' | 'assessment_r' | 'ws_fill';
+    /** Trading book at close time. The cooldown gate filters to the current
+     *  book so a paper loss can't cool down a live entry after a mode flip.
+     *  Legacy records (absent) match either book — they age out of any
+     *  realistic cooldown window within the hour anyway. */
+    mode?: 'paper' | 'live';
+    /** Realized R at close where a source had it (agent assessment on live
+     *  tool-closes). Feeds the WS2 directional scoreboard. */
+    realizedR?: number;
+    /** Realized net PnL (quote ccy) where engine/exchange-exact (paper engine,
+     *  WS bracket fills). Feeds the WS2 directional scoreboard. */
+    realizedPnl?: number;
     closedAtMs: number;
 }
 /** Signal-bar duration for a strategy/setup name. Name-suffix inference:
@@ -26,6 +42,27 @@ export declare class ReentryTracker {
     /** Most recent exit for (symbol[, setup]). A setup-specific record wins over
      *  a symbol-only match so multi-strategy books get precise cautions. */
     lastExit(symbol: string, setupType?: string): ReentryExitRecord | undefined;
+    /** Most recent LOSSY exit for `symbol` within `windowMs`, or undefined.
+     *  Feeds the reentryCooldown gate (evidence 2026-09-02: 58 re-entries within
+     *  60m of a same-symbol losing close ran −0.077R mean vs +0.090R baseline).
+     *  Any direction, any setup — the measured pathology is symbol churn, not
+     *  setup churn. `mode` filters to the current trading book; records without
+     *  a mode tag (pre-upgrade) match either book. */
+    lastLossyExit(symbol: string, windowMs: number, opts?: {
+        mode?: 'paper' | 'live';
+        nowMs?: number;
+    }): ReentryExitRecord | undefined;
+    /** Trailing consecutive LOSSY closes on `book`, newest first, across ALL
+     *  symbols — the live feed for the graduated loss-streak sizing brake in
+     *  preTradeRiskCheck (WS1, docs/MARKET_ADAPTIVITY_PLAN.md §3; live was fed a
+     *  hardcoded 0 since the beginning while paper computed it from engine
+     *  history). Semantics: a WIN breaks the streak, and so does an
+     *  UNKNOWN-outcome record (wasLoss undefined) — unknown is never counted as
+     *  a loss, and stopping there under-counts, which only makes the brake
+     *  gentler. Records from the OTHER book are skipped entirely (a paper loss
+     *  neither extends nor breaks a live streak); legacy untagged records match
+     *  either book, same as lastLossyExit. */
+    consecutiveLosses(book: 'paper' | 'live'): number;
     /** Structured caution when (symbol, strategy) was already traded within the
      *  current signal bar. Undefined = no caution. Pure indication (issue #204):
      *  the agent decides; nothing here blocks an order. */

package/portfolio/reentry-tracker.js

@@ -98,6 +98,55 @@ export class ReentryTracker {
         }
         return bySetup ?? bySymbol;
     }
+    /** Most recent LOSSY exit for `symbol` within `windowMs`, or undefined.
+     *  Feeds the reentryCooldown gate (evidence 2026-09-02: 58 re-entries within
+     *  60m of a same-symbol losing close ran −0.077R mean vs +0.090R baseline).
+     *  Any direction, any setup — the measured pathology is symbol churn, not
+     *  setup churn. `mode` filters to the current trading book; records without
+     *  a mode tag (pre-upgrade) match either book. */
+    lastLossyExit(symbol, windowMs, opts) {
+        const key = normalizeBracketSymbol(symbol);
+        const now = opts?.nowMs ?? Date.now();
+        for (let i = this.records.length - 1; i >= 0; i--) {
+            const r = this.records[i];
+            if (r.symbol !== key)
+                continue;
+            if (r.wasLoss !== true)
+                continue;
+            if (opts?.mode && r.mode && r.mode !== opts.mode)
+                continue;
+            const ageMs = now - r.closedAtMs;
+            // Tolerate small clock skew on exchange timestamps (up to 60s in the
+            // future still counts as "just closed").
+            if (ageMs >= -60_000 && ageMs <= windowMs)
+                return r;
+        }
+        return undefined;
+    }
+    /** Trailing consecutive LOSSY closes on `book`, newest first, across ALL
+     *  symbols — the live feed for the graduated loss-streak sizing brake in
+     *  preTradeRiskCheck (WS1, docs/MARKET_ADAPTIVITY_PLAN.md §3; live was fed a
+     *  hardcoded 0 since the beginning while paper computed it from engine
+     *  history). Semantics: a WIN breaks the streak, and so does an
+     *  UNKNOWN-outcome record (wasLoss undefined) — unknown is never counted as
+     *  a loss, and stopping there under-counts, which only makes the brake
+     *  gentler. Records from the OTHER book are skipped entirely (a paper loss
+     *  neither extends nor breaks a live streak); legacy untagged records match
+     *  either book, same as lastLossyExit. */
+    consecutiveLosses(book) {
+        let n = 0;
+        for (let i = this.records.length - 1; i >= 0; i--) {
+            const r = this.records[i];
+            if (r.mode && r.mode !== book)
+                continue;
+            if (r.wasLoss === true) {
+                n++;
+                continue;
+            }
+            break; // win or unknown outcome ends the trailing streak
+        }
+        return n;
+    }
     /** Structured caution when (symbol, strategy) was already traded within the
      *  current signal bar. Undefined = no caution. Pure indication (issue #204):
      *  the agent decides; nothing here blocks an order. */

package/signals/change-of-character.d.ts

@@ -0,0 +1,38 @@
+/** 30m move ≥ this ×ATR(1h) ⇒ 'shock'. */
+export declare const SHOCK_ATR_MULT_30M = 2;
+/** 4h tape opposing a directional regime label by ≥ this ×ATR(1h) ⇒ 'regime_tape_disagreement'. */
+export declare const DISAGREEMENT_ATR_MULT_4H = 2;
+export type ChangeOfCharacterFlag = 'shock' | 'regime_tape_disagreement';
+export interface ChangeOfCharacter {
+    /** |price now − close ~30m ago| ÷ ATR(1h). */
+    shock30mAtr: number;
+    /** (max high − min low) over the last ~30m ÷ ATR(1h) — catches a spike-and-revert the close-to-close move misses. */
+    range30mAtr: number;
+    /** % return vs the close ~1h ago. */
+    return1hPct: number;
+    /** % return vs the close ~4h ago. */
+    return4hPct: number;
+    /** Signed (price now − close ~4h ago) ÷ ATR(1h) — the tape the regime label must answer to. */
+    tape4hAtr: number;
+    /** ATR(1h) as % of price — the volatility yardstick the multiples are in. */
+    atrPct: number;
+    flags: ChangeOfCharacterFlag[];
+    /** Agent-facing one-liner. Present ONLY when a flag fired — silence stays silent. */
+    summary?: string;
+}
+interface BarLike {
+    high: number;
+    low: number;
+    close: number;
+}
+export interface ChangeOfCharacterInputs {
+    /** 5m bars, oldest first (≥7 required). */
+    ohlcv5m: BarLike[];
+    /** 1h bars, oldest first (≥5 required). */
+    ohlcv1h: BarLike[];
+    atr14: number;
+    currentPrice: number;
+    regime: string;
+}
+export declare function computeChangeOfCharacter(inputs: ChangeOfCharacterInputs): ChangeOfCharacter | undefined;
+export {};

package/signals/change-of-character.js

@@ -0,0 +1,93 @@
+// ⚠️ GENERATED FILE — DO NOT EDIT.
+// Canonical source of truth: shared/src/signals/change-of-character.ts
+// Regenerate: node scripts/sync-shared-code.mjs  (enforced by shared-code-sync.test.ts)
+//
+// This copy exists because this package builds with tsc and deploys as a
+// self-contained tree that strips workspace deps, so it cannot import
+// @reefclaw/shared runtime code across the deploy boundary.
+// Change-of-character detection — WS2 of docs/MARKET_ADAPTIVITY_PLAN.md.
+//
+// The 2026-09 adaptivity investigation found the agent keeps trading a stale
+// directional view after event-driven regime flips because (a) the regime
+// label is computed from realized bars and lags a shock by hours, and (b) no
+// input ever shows it the contradiction. This module computes the two fast
+// counter-evidence facts from data the fact-computer already has in hand —
+// NO new DB queries (the intel hot-query chunk-exclusion rule is not in play):
+//
+//   - SHOCK: the last ~30 minutes moved a multiple of the hourly ATR. An
+//     hourly ATR is roughly "a typical hour's range", so 2×ATR inside 30m is
+//     ~4× the typical rate — announcement territory.
+//   - REGIME/TAPE DISAGREEMENT: the regime label says TREND_UP (or DOWN) but
+//     the realized 4h tape moved ≥2×ATR the other way — the label is lagging.
+//
+// Pure function, deterministic, fail-open: insufficient bars or a degenerate
+// ATR returns undefined and every consumer treats that as "no signal".
+// Thresholds are exported so the soak can be re-cut without archaeology.
+// Canonical copy lives in shared/src/signals/ and is synced to
+// intelligence/ + plugin/ via scripts/sync-shared-code.mjs (drift-tested).
+/** 30m move ≥ this ×ATR(1h) ⇒ 'shock'. */
+export const SHOCK_ATR_MULT_30M = 2.0;
+/** 4h tape opposing a directional regime label by ≥ this ×ATR(1h) ⇒ 'regime_tape_disagreement'. */
+export const DISAGREEMENT_ATR_MULT_4H = 2.0;
+const fin = (v) => Number.isFinite(v);
+const round2 = (v) => Math.round(v * 100) / 100;
+export function computeChangeOfCharacter(inputs) {
+    const { ohlcv5m, ohlcv1h, atr14, currentPrice, regime } = inputs;
+    if (!fin(atr14) || atr14 <= 0 || !fin(currentPrice) || currentPrice <= 0)
+        return undefined;
+    if (!Array.isArray(ohlcv5m) || ohlcv5m.length < 7)
+        return undefined;
+    if (!Array.isArray(ohlcv1h) || ohlcv1h.length < 5)
+        return undefined;
+    // ~30m window = last 6 closed 5m bars; the reference close sits just before it.
+    const last6 = ohlcv5m.slice(-6);
+    const ref30m = ohlcv5m[ohlcv5m.length - 7].close;
+    const ref1h = ohlcv1h[ohlcv1h.length - 2].close;
+    const ref4h = ohlcv1h[ohlcv1h.length - 5].close;
+    if (!fin(ref30m) || ref30m <= 0 || !fin(ref1h) || ref1h <= 0 || !fin(ref4h) || ref4h <= 0) {
+        return undefined;
+    }
+    const shock30mAtr = Math.abs(currentPrice - ref30m) / atr14;
+    const hi30 = Math.max(...last6.map((b) => b.high));
+    const lo30 = Math.min(...last6.map((b) => b.low));
+    const range30mAtr = fin(hi30) && fin(lo30) && hi30 >= lo30 ? (hi30 - lo30) / atr14 : 0;
+    const return1hPct = (currentPrice / ref1h - 1) * 100;
+    const return4hPct = (currentPrice / ref4h - 1) * 100;
+    const tape4hAtr = (currentPrice - ref4h) / atr14;
+    const atrPct = (atr14 / currentPrice) * 100;
+    const flags = [];
+    if (Math.max(shock30mAtr, range30mAtr) >= SHOCK_ATR_MULT_30M)
+        flags.push('shock');
+    const labelDir = regime === 'TREND_UP' ? 1 : regime === 'TREND_DOWN' ? -1 : 0;
+    const opposing = labelDir !== 0 && Math.sign(tape4hAtr) === -labelDir;
+    if (opposing && Math.abs(tape4hAtr) >= DISAGREEMENT_ATR_MULT_4H) {
+        flags.push('regime_tape_disagreement');
+    }
+    const out = {
+        shock30mAtr: round2(shock30mAtr),
+        range30mAtr: round2(range30mAtr),
+        return1hPct: round2(return1hPct),
+        return4hPct: round2(return4hPct),
+        tape4hAtr: round2(tape4hAtr),
+        atrPct: round2(atrPct),
+        flags,
+    };
+    if (flags.length > 0)
+        out.summary = buildSummary(out, regime);
+    return out;
+}
+function buildSummary(c, regime) {
+    const parts = [];
+    if (c.flags.includes('shock')) {
+        parts.push(`SHOCK: last 30m moved ${round2(Math.max(c.shock30mAtr, c.range30mAtr))}×ATR ` +
+            `(${c.return1hPct >= 0 ? '+' : ''}${c.return1hPct}% on the hour)`);
+    }
+    if (c.flags.includes('regime_tape_disagreement')) {
+        parts.push(`regime label '${regime}' contradicts the 4h tape ` +
+            `(${c.tape4hAtr >= 0 ? '+' : ''}${c.tape4hAtr}×ATR / ` +
+            `${c.return4hPct >= 0 ? '+' : ''}${c.return4hPct}%) — the label LAGS realized price`);
+    }
+    return (`MARKET SHIFT — ${parts.join('; ')}. Re-derive direction from fresh price data ` +
+        `before entering; on open positions, check the pinned invalidation FIRST and do not ` +
+        `lean on prior theses formed before this move.`);
+}

package/simulator/exchange-simulator.d.ts

@@ -76,7 +76,11 @@ export declare class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice?: number): CcxtOrder;
+    referencePrice?: number, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit?: boolean): CcxtOrder;
     cancelOrder(orderId: string): CcxtOrder;
     cancelAllOrders(symbol?: string): CcxtOrder[];
     /**

package/simulator/exchange-simulator.js

@@ -290,17 +290,29 @@ export class ExchangeSimulator extends EventEmitter {
      *  market branch prices off THIS instead of the last tick, and skips the
      *  stale-quote guard — the caller supplied the price, so quote age is
      *  irrelevant, and a protective exit must never be blocked (issue #202). */
-    referencePrice) {
+    referencePrice, 
+    /** Set ONLY by closePosition for mechanical/operator-initiated exits —
+     *  exempts them from the startup lockout. Never reachable from the
+     *  agent-facing create_order path. */
+    protectiveExit) {
         // ---- Startup trade lockout ----
         // Block trades during the first 15s after gateway restart IF there were
         // existing positions at startup. This prevents stale agent sessions from
         // selling positions before the session is cleared and the agent re-reads SKILL.md.
         // Only activates when positions exist (nothing to protect if starting empty).
+        // Protective exits pass through: a stop breached 3s after a restart must
+        // close NOW — blocking the watcher here left positions unprotected for
+        // the whole window (open item since 2026-07-27).
         const elapsed = Date.now() - this.startupTime;
         if (this.hadPositionsAtStartup && elapsed < ExchangeSimulator.STARTUP_LOCKOUT_MS) {
-            const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
-            logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
-            throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            if (protectiveExit) {
+                logger.info(TAG, `Startup lockout bypassed for protective exit: ${side} ${amount} ${symbol}`);
+            }
+            else {
+                const remaining = Math.ceil((ExchangeSimulator.STARTUP_LOCKOUT_MS - elapsed) / 1000);
+                logger.warn(TAG, `STARTUP LOCKOUT: Blocked ${side} ${amount} ${symbol} — ${remaining}s remaining. This prevents stale session trades during restart.`);
+                throw new Error(`Trade blocked: startup lockout (${remaining}s remaining). The gateway just restarted — wait for the agent to re-read its instructions and check positions before trading.`);
+            }
         }
         if (amount <= 0) {
             throw new Error('Order amount must be positive');
@@ -410,9 +422,15 @@ export class ExchangeSimulator extends EventEmitter {
         if (closeReason) {
             position.metadata = { ...(position.metadata ?? {}), closeReason };
         }
-        // Create opposing market order to close the position
+        // Create opposing market order to close the position.
+        // Mechanical / operator-initiated exits (stop_watcher, exchange_target,
+        // emergency, operator, bracket_attach_failed, …) must never wait out the
+        // startup lockout — a stop breached seconds after a restart has to close
+        // immediately. Only discretionary closes ('agent' or reason-less) keep
+        // the stale-session guard.
+        const protectiveExit = closeReason !== undefined && closeReason !== 'agent';
         const closeSide = position.side === 'long' ? 'sell' : 'buy';
-        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice);
+        return this.createOrder(symbol, closeSide, 'market', position.quantity, undefined, undefined, referencePrice, protectiveExit);
     }
     /** Paper-only: move an open position's MUTABLE protective levels (stopPrice /
      *  targetPrice) in place and persist, WITHOUT the close+reopen round-trip

package/simulator/types.d.ts

@@ -150,6 +150,17 @@ export interface PositionMetadata {
     /** The agent's stated profit-realization plan, pinned at entry (indication,
      *  not an enforced mechanic). */
     realizationRule?: RealizationRule;
+    /** Re-entry cooldown gate eval, present ONLY when the gate TRIGGERED on this
+     *  entry (a same-symbol loss within the window) and the order fired anyway
+     *  (shadow/observe). Journaled to position_entries.metadata.reentry_cooldown
+     *  so the shadow soak can measure the would-block cohort's forward outcomes
+     *  against untagged entries (tools/reentry-cooldown.ts). */
+    reentryCooldown?: {
+        mode: 'shadow' | 'observe' | 'enforce';
+        minutesSinceLoss: number;
+        cooldownMinutes: number;
+        wouldBlock: boolean;
+    };
     /** Entry price as it was at the moment of the FIRST fill, frozen. MFE-in-R is
      *  denominated against this (and originalStopPrice), never against the
      *  position's running averaged entryPrice — otherwise a scale-in would

package/skills/reefclaw/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reefclaw
-version: 0.0.9
+version: 0.0.10
 description: ReefClaw trading control room — bootstrap (connects your agent; the full trading instructions arrive after first connect as a signed, signature-verified update)
 author: ReefClaw
 homepage: https://reefclaw.com
@@ -108,7 +108,7 @@ That is the whole install. It places the plugin, sets up the connector, restarts
 
 **Do not attempt to perform this install yourself, and do not work around it if it is unavailable to you.** Specifically: do not edit OpenClaw's configuration to enable chat install commands, do not add anyone to an owner or elevated-exec allowlist, do not enable elevated mode, and do not restart the gateway to widen your own permissions. If you cannot run the command, the correct outcome is to hand the user the one line above and let them run it deliberately. A trading integration is exactly the kind of software whose installation a human should perform knowingly.
 
-**If the user installs via ClawHub instead** and sees a security warning ("Security scan: suspicious"): that is expected and honest — ReefClaw is a trading plugin, and it discloses live-trading capability, exchange-credential storage, and remote instruction updates, which ClawHub flags for review (its linked security page has the details; VirusTotal reports the artifact clean). The chat command cannot acknowledge that warning, so the user should either use the `npx` line above, or — having read the warning — run `openclaw plugins install clawhub:@reefclaw/openclaw-plugin --acknowledge-clawhub-risk` themselves in a terminal.
+**If the user installs via ClawHub instead** — no terminal needed on OpenClaw 2026.8.1 or newer: either OpenClaw's Control UI (Plugins → Discover → search "reefclaw" → Install → accept the listed capabilities), or the chat command `/plugins install clawhub:@reefclaw/openclaw-plugin` followed, after reading the capability list it replies with, by the same command plus `--accept-capabilities` (the chat command needs `commands.plugins: true` in openclaw.json, which only the user sets). ClawHub labels the plugin "Security scan: suspicious". That is expected and honest — ReefClaw discloses live-trading capability, exchange-credential storage, and remote instruction updates, which ClawHub flags for review (its linked security page has the details; VirusTotal reports the artifact clean). OpenClaw 2026.8.1+ shows that audit and continues once the capabilities are accepted; OpenClaw 2026.7.x still blocks the chat command on that label — there the user runs the `npx` line above, or `openclaw plugins install clawhub:@reefclaw/openclaw-plugin --acknowledge-clawhub-risk` in a terminal.
 
 Whatever the install path, **save the connection settings anyway** — the connector picks them up automatically the moment the plugin is running.
 

package/strategy/evaluator.d.ts

@@ -5,6 +5,10 @@ export interface SymbolFact {
     conditions: Record<string, boolean>;
     regime: string;
     regime_confidence: number;
+    /** Change-of-character block computed by the intel fact-computer (WS2,
+     *  docs/MARKET_ADAPTIVITY_PLAN.md §3). Absent on older intel builds or when
+     *  inputs were insufficient — consumers treat absence as "no signal". */
+    changeOfCharacter?: import('../signals/change-of-character.js').ChangeOfCharacter;
 }
 export interface ConditionConfig {
     type: string;

package/tools/close-position.js

@@ -317,9 +317,18 @@ export async function closePositionTool(args, deps) {
                         'Use get_wave9_status for a reversal authorization or operator_command for an emergency close.');
                 }
             }
+            // Thread the validated reason to the adapter as its CloseReason:
+            // 'operator_command' maps to 'operator' so an operator-driven close is
+            // never caught by the paper startup lockout (whose protective-exit
+            // carve-out keys on the reason — before this, the tool dropped the
+            // reason entirely and EVERY generic close arrived as discretionary).
+            // All other reasons are agent-discretionary by design and stay subject
+            // to the lockout; the rich reason still reaches the journal via
+            // close_reason, this only fixes the adapter-level class + metadata.
+            const adapterCloseReason = args.reason === 'operator_command' ? 'operator' : 'agent';
             return wave9ExitClaimed
                 ? deps.adapter.closePosition(args.symbol, 'wave9_signal_reversal')
-                : deps.adapter.closePosition(args.symbol);
+                : deps.adapter.closePosition(args.symbol, adapterCloseReason);
         };
         const closeWave9 = async () => {
             if (!wave9Lease)

package/tools/create-order.js

@@ -7,6 +7,10 @@ import { fetchCurrentPrice, fetchOrderBook, isError } from './helpers.js';
 import { validateCreateOrder, sanitizeRealizationRule, validateProtectiveGeometry } from './assessment-validation.js';
 import { preTradeRiskCheck, getDefaultPreTradeLimits, computeConsecutiveLosses } from '../risk/pre-trade-check.js';
 import { bracketsEnabled, loadBracketMode, loadBracketRequirements } from '../config/brackets-config.js';
+import { loadReentryCooldownMinutes, loadReentryCooldownMode, } from '../config/reentry-cooldown-config.js';
+import { resolveLossStreakSizingMode } from '../config/loss-streak-config.js';
+import { buildReentryCooldownRejection, evaluateReentryCooldown, } from './reentry-cooldown.js';
+import { normalizeBracketSymbol } from '../live/bracket-ledger.js';
 import { onCreateOrderFilled } from '../ingest/position-auto-capture.js';
 import { wave9ClientOrderId, } from '../wave9/live-execution-ledger.js';
 import { inspectWave9LiveSymbolOwnership, } from '../wave9/live-symbol-ownership.js';
@@ -1012,7 +1016,24 @@ export async function createOrderTool(args, deps) {
         }
         else {
             portfolio = await (livePortfolioPromise ?? buildPortfolioSnapshotFromAdapter(deps.adapter));
-            // In live mode, consecutive losses would come from intelligence DB — use 0 for now
+            // WS1 (docs/MARKET_ADAPTIVITY_PLAN.md §3): the graduated loss-streak
+            // sizing brake was fed a hardcoded 0 on live since the beginning. Real
+            // feed = trailing lossy closes on the live book from the ReentryTracker
+            // records. RC_LOSS_STREAK_SIZING = off | log (sizing unaffected) |
+            // enforce (DEFAULT since 2026-09-05 — live/paper parity restored after
+            // the log soak).
+            const streakMode = resolveLossStreakSizingMode();
+            if (streakMode !== 'off' && deps.autoCapture?.reentryTracker) {
+                const liveStreak = deps.autoCapture.reentryTracker.consecutiveLosses('live');
+                if (liveStreak > 0) {
+                    logger.info('loss-streak', `live consecutive losses=${liveStreak} (mode=${streakMode}` +
+                        (streakMode === 'log'
+                            ? ' — sizing UNAFFECTED; RC_LOSS_STREAK_SIZING=enforce applies the graduated reduction)'
+                            : ')'));
+                }
+                if (streakMode === 'enforce')
+                    consecutiveLosses = liveStreak;
+            }
         }
         // Bracket enforcement only applies in live mode when the feature is enabled.
         // Paper mode uses the stop-watcher and doesn't care about these flags.
@@ -1048,6 +1069,43 @@ export async function createOrderTool(args, deps) {
             const reasons = riskCheck.violations.map(v => v.message).join('; ');
             return rejectWave9Divergence(`Order REJECTED by risk gate [${riskCheck.drawdownZone} zone]: ${reasons}`, `generic_pretrade_divergence:${riskCheck.violations.map((v) => v.rule).join(',')}`);
         }
+        // ---- Re-entry cooldown gate (mode-laddered; ships 'off') ----
+        // Generic NEW entries only: wave9 has its own frozen admission policy,
+        // scale-ins and operator-approved proposal fires are exempt inside the
+        // evaluator, and this branch can only ever suppress a new entry — exits,
+        // closes, stops, and emergency paths never route through it. Mode resolves
+        // PER CALL (central → file → off) so a gate flip hot-applies, same as the
+        // exit gate. See tools/reentry-cooldown.ts for the measurement behind it.
+        let reentryCooldownEval;
+        if (!wave9Claimed) {
+            const rcMode = loadReentryCooldownMode();
+            if (rcMode !== 'off') {
+                const symbolKey = normalizeBracketSymbol(args.symbol);
+                reentryCooldownEval = evaluateReentryCooldown({
+                    symbol: args.symbol,
+                    mode: rcMode,
+                    tracker: deps.autoCapture?.reentryTracker,
+                    book: deps.adapter.isLive ? 'live' : 'paper',
+                    cooldownMinutes: loadReentryCooldownMinutes(),
+                    hasOpenPosition: portfolio.positions.some((p) => normalizeBracketSymbol(p.symbol) === symbolKey && Math.abs(p.quantity) > 0),
+                    isListenerFire: deps.entryClientOrderId != null,
+                });
+                if (reentryCooldownEval.triggered) {
+                    const detail = `${args.symbol} ${side}: lossy close ${reentryCooldownEval.minutesSinceLoss}m ago ` +
+                        `(window=${reentryCooldownEval.cooldownMinutes}m, mode=${rcMode}, ` +
+                        `loss_source=${reentryCooldownEval.lastLoss?.lossSource ?? 'unknown'})`;
+                    if (rcMode === 'shadow') {
+                        logger.info('reentry-cooldown', `WOULD BLOCK (shadow) ${detail}`);
+                    }
+                    else {
+                        logger.warn('reentry-cooldown', `${rcMode === 'enforce' ? 'BLOCKED' : 'WOULD BLOCK (observe)'} ${detail}`);
+                    }
+                    if (reentryCooldownEval.blocked) {
+                        return { error: buildReentryCooldownRejection(reentryCooldownEval, args.symbol) };
+                    }
+                }
+            }
+        }
         // Build position metadata from optional args (only if any metadata provided)
         // Sanitize numeric metadata — reject non-finite values, clamp ranges
         const num = (v) => typeof v === 'number' && Number.isFinite(v) ? v : undefined;
@@ -1055,9 +1113,20 @@ export async function createOrderTool(args, deps) {
             const n = num(v);
             return n != null ? Math.max(min, Math.min(max, n)) : undefined;
         };
+        // Journal-tag a TRIGGERED cooldown eval (shadow/observe fire-anyway cohort —
+        // the measurement rows the promote-to-enforce decision reads).
+        const reentryCooldownTag = reentryCooldownEval?.triggered
+            ? {
+                mode: reentryCooldownEval.mode,
+                minutesSinceLoss: reentryCooldownEval.minutesSinceLoss ?? 0,
+                cooldownMinutes: reentryCooldownEval.cooldownMinutes,
+                wouldBlock: true,
+            }
+            : undefined;
         const hasMetadata = args.mission_id || args.setup_type || args.thesis || args.target_price != null
             || args.regime || args.scorecard_verdict || args.confluence_score != null
-            || args.invalidation_price != null || args.realization_rule != null;
+            || args.invalidation_price != null || args.realization_rule != null
+            || reentryCooldownTag != null;
         const metadata = hasMetadata ? {
             missionId: args.mission_id,
             setupType: args.setup_type,
@@ -1076,6 +1145,7 @@ export async function createOrderTool(args, deps) {
             confluenceScore: clamp(args.confluence_score, 0, 10),
             invalidationPrice: num(args.invalidation_price),
             realizationRule: sanitizeRealizationRule(args.realization_rule),
+            reentryCooldown: reentryCooldownTag,
         } : undefined;
         // ---- Approval-mode branches ----
         // Both shadow and per_trade need full v2.10.0 metadata so the proposal is

package/tools/hl-provision-agent-wallet.js

@@ -96,22 +96,40 @@ export async function hlProvisionAgentWalletTool(args, deps) {
         const derived = await deriveAddressFromPrivateKey(existingKey);
         if (derived.ok) {
             const masterMatches = existingMaster != null && existingMaster.toLowerCase() === walletAddress.toLowerCase();
-            // ★ Honour a CHANGED network on the resume path. The same keypair is
-            // valid on both Hyperliquid networks, so switching mainnet<->testnet
-            // must not require regenerating the wallet — but the stored flag has to
-            // follow, or the box boots against the network the operator did NOT
-            // pick. Before this, unticking "Use Hyperliquid testnet" after
-            // provisioning silently kept testnet:true, and the approval was signed
-            // for Testnet while the operator believed they were on mainnet
-            // (observed live 2026-08-03).
-            if (masterMatches && existingTestnet !== testnet) {
+            // ★ Re-ACTIVATE the venue on resume (E2E audit 2026-08-11 #6) and honour
+            // a CHANGED network in the same write.
+            //
+            // Venue: the resume path used to write NOTHING unless the network flag
+            // moved — so a box whose active venue was still binance (HL provisioned
+            // earlier and switched back, or a live-Binance box that just clicked
+            // through the confirm-switch dialog above) kept `venue:'binance'` on
+            // disk. hl_agent_wallet_status only reports configured when
+            // `exchange.venue==='hyperliquid'`, so the guided flow dead-ended
+            // polling configured:false forever, and the confirm dialog "switched"
+            // nothing. By this point the venue-switch confirm gate has already run,
+            // so the activation write is authorized. buildVenueExchangeConfig with
+            // empty fields activates the venue while keeping BOTH venues'
+            // credentials (the merge contract).
+            //
+            // Network: the same keypair is valid on both Hyperliquid networks, so
+            // mainnet<->testnet must not require regenerating — but the stored flag
+            // has to follow, or the box boots against the network the operator did
+            // NOT pick (observed live 2026-08-03: approval signed for Testnet while
+            // the operator believed mainnet).
+            const needsVenueActivation = fromVenue !== 'hyperliquid';
+            if (masterMatches && (needsVenueActivation || existingTestnet !== testnet)) {
                 try {
                     updatePluginConfig({ exchange: buildVenueExchangeConfig(existingExchange, 'hyperliquid', {}, testnet) }, deps.configPath);
+                    if (needsVenueActivation) {
+                        logger.info(TAG, 'venue re-activated: hyperliquid (existing agent wallet resumed)');
+                    }
+                    if (existingTestnet !== testnet) {
+                        logger.info(TAG, `network switched to ${testnet ? 'TESTNET' : 'MAINNET'} (same agent wallet)`);
+                    }
                     existingTestnet = testnet;
-                    logger.info(TAG, `network switched to ${testnet ? 'TESTNET' : 'MAINNET'} (same agent wallet)`);
                 }
                 catch (err) {
-                    logger.warn(TAG, `could not persist network change: ${err instanceof Error ? err.message : String(err)}`);
+                    logger.warn(TAG, `could not persist venue/network change: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
             return {

package/tools/reentry-cooldown.d.ts

@@ -0,0 +1,33 @@
+import type { ReentryExitRecord, ReentryTracker } from '../portfolio/reentry-tracker.js';
+export type ReentryCooldownMode = 'off' | 'shadow' | 'observe' | 'enforce';
+export interface ReentryCooldownEval {
+    /** Mode the gate ran under (never 'off' — off is not evaluated). */
+    mode: Exclude<ReentryCooldownMode, 'off'>;
+    /** A lossy same-symbol close exists within the cooldown window. */
+    triggered: boolean;
+    /** triggered && mode === 'enforce' — caller must reject the order. */
+    blocked: boolean;
+    code: 'no_recent_loss' | 'cooldown_active' | 'scale_in_exempt' | 'operator_approved_exempt' | 'tracker_unavailable';
+    cooldownMinutes: number;
+    /** Minutes since the arming loss (only when triggered). */
+    minutesSinceLoss?: number;
+    /** The arming loss (only when triggered). */
+    lastLoss?: Pick<ReentryExitRecord, 'side' | 'setupType' | 'closedAtMs' | 'lossSource'>;
+}
+export interface ReentryCooldownInputs {
+    symbol: string;
+    mode: Exclude<ReentryCooldownMode, 'off'>;
+    tracker: Pick<ReentryTracker, 'lastLossyExit'> | undefined;
+    /** Current trading book — filters tracker records after a paper↔live flip. */
+    book: 'paper' | 'live';
+    cooldownMinutes: number;
+    /** Same-symbol position already open → this order is a scale-in, exempt. */
+    hasOpenPosition: boolean;
+    /** ProposalDecisionListener fire of an operator-APPROVED proposal, exempt. */
+    isListenerFire: boolean;
+    nowMs?: number;
+}
+export declare function evaluateReentryCooldown(inputs: ReentryCooldownInputs): ReentryCooldownEval;
+/** Agent-facing rejection for enforce mode. Names the gate, the remaining
+ *  wait, and the honest path forward — no bypass hint by design. */
+export declare function buildReentryCooldownRejection(ev: ReentryCooldownEval, symbol: string): string;