@reefclaw/openclaw-plugin 0.1.26 → 0.1.27

package/index.js

@@ -1001,6 +1001,13 @@ const paperTradingPlugin = {
                 logger.warn(TAG, `State reload failed: ${formatError(err)}`);
             }
         };
+        // Out-of-tool readers (periodic DB-vs-exchange sweep, stop-watcher) read
+        // the PaperAdapter directly and never went through reloadState — in the
+        // process that did not execute the entry they saw a stale book and posted
+        // false `reconciler_observed_flat` closes seconds after every entry
+        // (2026-09-14). Hook on the simulator so every adapter built from it
+        // (boot + every reconnect path) refreshes before a read.
+        simulator.setStateRefresher(reloadState);
         // Read config: ReefClaw plugin config from ~/.reefclaw/plugin-config.json
         // (OpenClaw's schema validation rejects custom keys in plugin entries)
         let connectionToken = '';

package/ingest/reconcile-db-vs-exchange.d.ts

@@ -13,6 +13,14 @@ export interface DbVsExchangeContext {
      *  venue's snapshot can never contain. Absent → unscoped (legacy). */
     resolveExchange?: () => 'binance' | 'hyperliquid';
 }
+/** Rows opened more recently than this are never orphan-closed. An entry
+ *  that filled seconds ago and is "absent from the exchange" is propagation
+ *  lag, not an orphan: the paper book's debounced state.json save (1s) has
+ *  not landed in the other process yet, or a live fill's REST snapshot raced
+ *  the journal POST. A real orphan is still harvested by the next sweep
+ *  (5 min) — the grace costs nothing and removes the false-close class that
+ *  hit every entry on a paying tenant's box on 2026-09-14. */
+export declare const DEFAULT_MIN_OPEN_AGE_MS = 120000;
 /**
  * Close webapp `positions` rows that are status='open' but absent from the
  * (trusted) exchange snapshot. Returns the number of synthetic closes posted.
@@ -23,6 +31,9 @@ export interface DbVsExchangeContext {
 export interface DbReconcileOptions {
     /** Provenance tag written into closeAssessment.source (default boot sweep). */
     source?: string;
+    /** Young-row grace (ms); rows with `nowMs - openedAt < minOpenAgeMs` are
+     *  skipped with a log line. Default DEFAULT_MIN_OPEN_AGE_MS; 0 disables. */
+    minOpenAgeMs?: number;
     /** Attribution hook (issue #203): given an orphaned symbol, return a short
      *  human-readable description of what the execution engine last knew about
      *  it (e.g. the simulator's last trade). Logged with the synthetic close so
@@ -32,6 +43,8 @@ export interface DbReconcileOptions {
 export declare function reconcileDbOpenVsExchange(ctx: DbVsExchangeContext, exchangeSymbols: Iterable<string>, nowMs?: number, opts?: DbReconcileOptions): Promise<number>;
 export declare const DEFAULT_DB_RECONCILE_INTERVAL_MS = 300000;
 export interface PeriodicDbReconcileDeps extends DbVsExchangeContext {
+    /** Young-row grace forwarded to every sweep (default DEFAULT_MIN_OPEN_AGE_MS). */
+    minOpenAgeMs?: number;
     /** Resolve the ACTIVE adapter each tick (follows runtime reconnects). */
     resolveAdapter: () => {
         getPositionsOrNull(symbol?: string): Promise<Array<{

package/ingest/reconcile-db-vs-exchange.js

@@ -43,6 +43,14 @@ const TAG = 'reconcile-db-vs-exchange';
 function canonical(symbol) {
     return symbol.split(':')[0];
 }
+/** Rows opened more recently than this are never orphan-closed. An entry
+ *  that filled seconds ago and is "absent from the exchange" is propagation
+ *  lag, not an orphan: the paper book's debounced state.json save (1s) has
+ *  not landed in the other process yet, or a live fill's REST snapshot raced
+ *  the journal POST. A real orphan is still harvested by the next sweep
+ *  (5 min) — the grace costs nothing and removes the false-close class that
+ *  hit every entry on a paying tenant's box on 2026-09-14. */
+export const DEFAULT_MIN_OPEN_AGE_MS = 120_000;
 export async function reconcileDbOpenVsExchange(ctx, exchangeSymbols, nowMs = Date.now(), opts = {}) {
     if (!ctx.decisionsClient || !ctx.userId)
         return 0;
@@ -58,7 +66,16 @@ export async function reconcileDbOpenVsExchange(ctx, exchangeSymbols, nowMs = Da
     const exchangeSet = new Set();
     for (const s of exchangeSymbols)
         exchangeSet.add(canonical(s));
-    const orphans = resp.positions.filter((p) => !exchangeSet.has(canonical(p.symbol)));
+    const minOpenAgeMs = opts.minOpenAgeMs ?? DEFAULT_MIN_OPEN_AGE_MS;
+    const absent = resp.positions.filter((p) => !exchangeSet.has(canonical(p.symbol)));
+    const orphans = absent.filter((p) => {
+        const ageMs = nowMs - p.openedAt;
+        if (Number.isFinite(ageMs) && ageMs < minOpenAgeMs) {
+            logger.info(TAG, `${p.symbol}: opened ${Math.round(ageMs / 1000)}s ago and absent from the snapshot — within the ${Math.round(minOpenAgeMs / 1000)}s grace, not treated as an orphan (propagation lag; next sweep re-checks)`);
+            return false;
+        }
+        return true;
+    });
     if (orphans.length === 0) {
         logger.info(TAG, `DB reconcile: all ${resp.positions.length} open row(s) present on exchange`);
         return 0;
@@ -149,7 +166,11 @@ export function startPeriodicDbReconcile(deps, intervalMs = resolveDbReconcileIn
                 logger.warn(TAG, 'periodic sweep skipped — positions fetch untrusted (null)');
                 return 0;
             }
-            return await reconcileDbOpenVsExchange(deps, positions.map((p) => p.symbol), Date.now(), { source: 'db_exchange_sweep_periodic', describeLastExit: deps.describeLastExit });
+            return await reconcileDbOpenVsExchange(deps, positions.map((p) => p.symbol), Date.now(), {
+                source: 'db_exchange_sweep_periodic',
+                describeLastExit: deps.describeLastExit,
+                minOpenAgeMs: deps.minOpenAgeMs,
+            });
         }
         catch (err) {
             logger.warn(TAG, `periodic sweep failed: ${err instanceof Error ? err.message : String(err)}`);

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Supervised trading plugin for the ReefClaw dashboard. It runs on YOUR machine and starts in PAPER mode with no API keys. It cannot trade real funds until you supply exchange credentials and step PAPER→MICRO_LIVE→LIVE yourself from the dashboard — the agent cannot make that change (the tool is refused without operator provenance). Exchange keys stay local, are used only to sign requests to the exchange, and are never transmitted to ReefClaw (asserted by a test in this package). Trading telemetry — positions, fills, decision journal — is sent to ReefClaw to render the dashboard. Every live position carries exchange-native protective stops. Remote updates to the agent's trading instructions are applied only after an Ed25519 signature is verified against a public key pinned in this build.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "ReefClaw supervised trading plugin for OpenClaw. Runs entirely on YOUR machine and starts in PAPER mode — it cannot trade real funds until you supply exchange credentials and walk the PAPER→MICRO_LIVE→LIVE ladder yourself from the ReefClaw dashboard (the agent cannot make that change; it is refused without operator provenance). Your exchange API keys stay on your machine to sign requests to the exchange and are NEVER sent to ReefClaw — a test in the package asserts this. What does reach ReefClaw is trading telemetry for the dashboard (positions, fills, decision journal). Live trading always carries exchange-native protective stops. Trading instructions can be updated remotely, and every update must carry a valid Ed25519 signature verified against a key pinned in this build before it is applied. Install: npx --yes @reefclaw/connect, or from ClawHub on OpenClaw 2026.8.1+ (Control UI Plugins > Discover, or /plugins install clawhub:@reefclaw/openclaw-plugin then the same with --accept-capabilities after reviewing the listed capabilities)",
   "type": "module",
   "main": "index.js",

package/paper-adapter.js

@@ -25,17 +25,25 @@ export class PaperAdapter {
     async closePosition(symbol, closeReason) {
         return this.simulator.closePosition(symbol, closeReason);
     }
+    // Reads pull a newer state.json first (ExchangeSimulator.refreshState —
+    // no-op without a hook). Out-of-tool readers (DB-vs-exchange sweep,
+    // stop-watcher) otherwise see a stale book in the process that did not
+    // execute the entry and post false synthetic closes / phantom stop fills.
     async getBalance() {
+        this.simulator.refreshState();
         return this.simulator.getBalance();
     }
     async getPositions(symbol) {
+        this.simulator.refreshState();
         return this.simulator.getPositions(symbol);
     }
     /** Paper has no exchange fetch to fail — position state is always known. */
     async getPositionsOrNull(symbol) {
+        this.simulator.refreshState();
         return this.simulator.getPositions(symbol);
     }
     async getOpenOrders(symbol) {
+        this.simulator.refreshState();
         return this.simulator.getOpenOrders(symbol);
     }
     async fetchOrder(orderId, _symbol) {

package/simulator/exchange-simulator.d.ts

@@ -63,6 +63,13 @@ export declare class ExchangeSimulator extends EventEmitter {
      *  on open and is released on close, so we must add it back here. */
     computeEquity(): number;
     private getQuoteCurrency;
+    private stateRefresher;
+    /** Install the "reload state.json if it changed" hook (index.ts reloadState). */
+    setStateRefresher(fn: (() => void) | null): void;
+    /** Pull a newer on-disk snapshot before an out-of-tool read. No-op when no
+     *  hook is installed (tests / single-process). Never throws — a failed
+     *  reload leaves the current in-memory book in place. */
+    refreshState(): void;
     getBalance(): CcxtBalance;
     getPositions(symbol?: string): CcxtPosition[];
     getOpenOrders(symbol?: string): CcxtOrder[];

package/simulator/exchange-simulator.js

@@ -153,6 +153,36 @@ export class ExchangeSimulator extends EventEmitter {
     getQuoteCurrency() {
         return this.state.config?.quoteCurrency ?? 'USDT';
     }
+    // ---- Cross-process refresh (two-process architecture) ----
+    //
+    // The agent and gateway processes each hold their own ExchangeSimulator and
+    // share state through state.json. Every paper TOOL path calls index.ts
+    // reloadState() before reading, but out-of-tool readers (the periodic
+    // DB-vs-exchange sweep, the stop-watcher's 3s poll) read the adapter
+    // directly — and a process that did NOT execute the entry then sees a
+    // stale in-memory book. On 2026-09-14 that posted a synthetic
+    // `reconciler_observed_flat` close 5–100s after EVERY entry on a paying
+    // tenant's box while the engine kept the position alive for hours. The
+    // hook lives on the simulator (not the adapter) so every PaperAdapter ever
+    // built from it — boot or any reconnect path — inherits it.
+    stateRefresher = null;
+    /** Install the "reload state.json if it changed" hook (index.ts reloadState). */
+    setStateRefresher(fn) {
+        this.stateRefresher = fn;
+    }
+    /** Pull a newer on-disk snapshot before an out-of-tool read. No-op when no
+     *  hook is installed (tests / single-process). Never throws — a failed
+     *  reload leaves the current in-memory book in place. */
+    refreshState() {
+        if (!this.stateRefresher)
+            return;
+        try {
+            this.stateRefresher();
+        }
+        catch (err) {
+            logger.warn(TAG, `state refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // ---- Read operations (for tools) ----
     getBalance() {
         const free = {};