@reefclaw/openclaw-plugin 0.1.4 → 0.1.6

package/index.js

@@ -19,9 +19,10 @@ import { StateManager } from './persistence/state-manager.js';
 import { logger, setLogLevel, formatError } from './logger.js';
 import { DEFAULT_CONFIG } from './types.js';
 import { PaperAdapter } from './paper-adapter.js';
-import { createLiveAdapter, fillExchangeId, isLiveVenueSupported, parseVenue, } from './venues/registry.js';
+import { LiveAdapter, } from './live/live-adapter.js';
+import { createLiveAdapter, fillExchangeId, isLiveVenueSupported, parseVenue, venueQuoteCurrency, } from './venues/registry.js';
 import { HyperliquidPublicApi } from './venues/hyperliquid/hl-public.js';
-import { loadBracketMode } from './config/brackets-config.js';
+import { bracketsEnabled, loadBracketMode } from './config/brackets-config.js';
 import { loadUserDataStreamMode, loadUserDataStreamTunables, loadUserDataStreamDbWrite, getUserDataStreamIngestBaseUrl, resolveIngestToken, resolveReefclawUserId, } from './config/user-data-stream-config.js';
 import { TradeStoreClient } from './ingest/trade-store-client.js';
 import { ProposalManager } from './live/proposal-manager.js';
@@ -42,6 +43,7 @@ import { proposeLearningTool } from './tools/propose-learning.js';
 import { queryReviewOutcomesTool } from './tools/query-review-outcomes.js';
 import { loadPositionReviewMode } from './config/position-review-config.js';
 import { installSignalHandlers } from './lifecycle/install-signal-handlers.js';
+import { SerialTradingOperationLock } from './lifecycle/trading-operation-lock.js';
 import { readPluginConfig, readOpenClawConnection } from './config/plugin-config-io.js';
 import { startConnectorSupervisor, hasBundledBridge } from './connector-supervisor.js';
 import { ToolGate } from './config/tool-gate.js';
@@ -94,7 +96,7 @@ import { getRiskScenarioTool } from './tools/get-risk-scenario.js';
 import { getSessionReviewTool } from './tools/get-session-review.js';
 import { getBacktestTool } from './tools/get-backtest.js';
 import { saveStrategyTool } from './tools/save-strategy.js';
-import { listStrategiesTool } from './tools/list-strategies.js';
+import { listStrategiesTool, prepareListStrategiesArgs } from './tools/list-strategies.js';
 import { toggleStrategyTool } from './tools/toggle-strategy.js';
 import { getPatternScanTool } from './tools/get-pattern-scan.js';
 import { scanPairsTool } from './tools/scan-pairs.js';
@@ -110,6 +112,14 @@ import { getDivergencesTool } from './tools/get-divergences.js';
 import { getLiquidationPulseTool } from './tools/get-liquidation-pulse.js';
 import { getRestingLiquidityTool } from './tools/get-resting-liquidity.js';
 import { getFundingContextTool } from './tools/get-funding-context.js';
+import { captureWave9PaperAccountSnapshot, captureWave9PaperPositionFingerprint, Wave9PaperAdmissionGuard, } from './wave9/paper-admission-guard.js';
+import { captureWave9LiveAccount, captureWave9LivePosition, confirmWave9LiveNativeStop, } from './wave9/live-account-capture.js';
+import { Wave9LiveExecutionLedger } from './wave9/live-execution-ledger.js';
+import { recoverWave9LiveExposure } from './wave9/live-autonomous-protection.js';
+import { reconcileWave9LiveDurableRows, } from './wave9/live-startup-reconciliation.js';
+import { Wave9LiveDurableReconciliationScheduler } from './wave9/live-durable-reconciliation-scheduler.js';
+import { inspectWave9LiveSymbolOwnership, } from './wave9/live-symbol-ownership.js';
+import { getWave9StatusTool, IntelWave9ActivationClient, } from './tools/get-wave9-status.js';
 import { refreshTradingParams } from './trading-params-cache.js';
 const TAG = 'paper-trading';
 const PLUGIN_ID = 'reefclaw-paper-trading';
@@ -157,6 +167,9 @@ const TOOL_PARAMS = {
             amount: { type: 'number', description: 'Quantity in base currency (e.g. BTC amount)' },
             price: { type: 'number', description: 'Limit price (required for limit orders)' },
             stopPrice: { type: 'number', description: 'Protective stop-loss trigger price. REQUIRED in live mode when brackets.requireStopLoss is on (default). Must be below entry for longs, above entry for shorts.' },
+            mission_id: { type: 'string', description: 'Canonical mission ID for attribution. Wave 9 requires the exact mission ID returned by get_wave9_status.' },
+            candidate_id: { type: 'string', description: 'Wave 9 only: exact candidate ID returned by get_wave9_status. Invalid on generic orders.' },
+            wave9_admission_token: { type: 'string', description: 'Wave 9 only: short-lived single-use PAPER/LIVE admission token returned by get_wave9_status. Invalid on generic orders.' },
             setup_type: { type: 'string', description: 'Setup classification (e.g. pullback_to_ema, breakout, mean_reversion). REQUIRED in live mode.' },
             thesis: { type: 'string', description: 'Entry reason in 1-2 sentences (≥20 chars). REQUIRED in live mode — the heartbeat reassessment compares against this.' },
             target_price: { type: 'number', description: 'Planned profit target price. REQUIRED in live mode when brackets.requireTakeProfit is on (default).' },
@@ -191,9 +204,11 @@ const TOOL_PARAMS = {
             symbol: { type: 'string', description: 'Symbol of the position to close' },
             reason: {
                 type: 'string',
-                enum: ['regime_flip', 'risk_limit', 'bracket_integrity', 'operator_command'],
-                description: 'Why you are closing manually instead of letting brackets handle it. Must match the decision-matrix trigger in your thinking.',
+                enum: ['regime_flip', 'risk_limit', 'bracket_integrity', 'operator_command', 'wave9_signal_reversal'],
+                description: 'Why you are closing manually instead of letting brackets handle it. wave9_signal_reversal is reserved for an exact get_wave9_status exit authorization.',
             },
+            candidate_id: { type: 'string', description: 'Wave 9 only: exact held candidate ID returned by get_wave9_status.' },
+            wave9_exit_token: { type: 'string', description: 'Wave 9 only: short-lived single-use PAPER/LIVE signal-reversal exit token returned by get_wave9_status.' },
             assessment: {
                 type: 'object',
                 description: 'Structured reasoning — populated from a fresh scorecard run this heartbeat. Required for all reasons except operator_command. Reason-specific consistency is enforced server-side.',
@@ -505,6 +520,11 @@ const TOOL_PARAMS = {
         },
         required: ['symbol'],
     },
+    get_wave9_status: {
+        type: 'object',
+        properties: {},
+        additionalProperties: false,
+    },
     get_analytics: {
         type: 'object',
         properties: {
@@ -651,8 +671,10 @@ const TOOL_PARAMS = {
     list_strategies: {
         type: 'object',
         properties: {
-            active_only: { type: 'boolean', description: 'If true, only return active strategies (default: false — returns all)' },
+            active_only: { type: 'boolean', description: 'Required. Use true for every question about strategies active, usable, available, or tradeable now; use false only when the operator explicitly asks to include inactive strategies.' },
         },
+        required: ['active_only'],
+        additionalProperties: false,
     },
     toggle_strategy: {
         type: 'object',
@@ -876,11 +898,24 @@ const paperTradingPlugin = {
             return;
         }
         logger.info(TAG, 'Initializing paper trading plugin...');
-        // Resolve config from plugin settings
+        // Resolve config from plugin settings. The paper wallet's quote currency
+        // follows the VENUE (USDC on hyperliquid, USDT on binance — issue #174:
+        // a hardcoded USDT wallet reads as $0 equity on the USDC venue). The
+        // authoritative plugin-config read happens further down, AFTER the
+        // simulator exists — peek only the venue here; same file, same parse
+        // rules, and an unreadable config falls back to the binance default
+        // exactly like the main read does.
+        let paperQuoteCurrency = DEFAULT_CONFIG.quoteCurrency;
+        try {
+            paperQuoteCurrency = venueQuoteCurrency(parseVenue(readPluginConfig().exchange?.venue).venue);
+        }
+        catch {
+            /* unreadable plugin-config → binance default, matching the main read */
+        }
         const pluginConfig = {
             startingBalance: DEFAULT_CONFIG.startingBalance,
             symbol: DEFAULT_CONFIG.symbol,
-            quoteCurrency: DEFAULT_CONFIG.quoteCurrency,
+            quoteCurrency: paperQuoteCurrency,
         };
         logger.info(TAG, `Config: ${pluginConfig.startingBalance} ${pluginConfig.quoteCurrency}, symbol: ${pluginConfig.symbol}`);
         // Load or initialize state (sync — OpenClaw ignores async register())
@@ -913,6 +948,7 @@ const paperTradingPlugin = {
         let apiBaseUrl = 'https://www.reefclaw.com';
         let intelligenceUrl = 'https://intel.reefclaw.com';
         let exchangeConfig = null;
+        let hlCredentials = null;
         let tradingMode = 'PAPER';
         // Trading venue (multi-venue Phase 0 — docs/HYPERLIQUID_INTEGRATION_PLAN.md).
         // Absent config field = 'binance', so every pre-venue install is untouched.
@@ -956,6 +992,18 @@ const paperTradingPlugin = {
                         testnet: exchange.testnet ?? false,
                     };
                 }
+                // Hyperliquid credentials (Phase 3): a MASTER address (queries; holds the
+                // funds) + an AGENT wallet private key (signs; holds nothing, cannot
+                // withdraw or transfer — verified live 2026-07-12). Both are required:
+                // an agent key alone cannot be queried against, and an address alone
+                // cannot sign.
+                if (venue === 'hyperliquid' && exchange?.walletAddress && exchange?.agentPrivateKey) {
+                    hlCredentials = {
+                        walletAddress: String(exchange.walletAddress),
+                        agentPrivateKey: String(exchange.agentPrivateKey),
+                        testnet: exchange.testnet === true,
+                    };
+                }
                 // Read trading mode (default: PAPER)
                 const mode = rcConfig?.tradingMode?.toUpperCase();
                 if (mode === 'SHADOW' || mode === 'MICRO_LIVE' || mode === 'LIVE') {
@@ -991,10 +1039,18 @@ const paperTradingPlugin = {
             logger.warn(TAG, `Trading mode ${tradingMode} on venue '${venue}' is not supported in this build — falling back to PAPER (live support arrives in Phase 3 of docs/HYPERLIQUID_INTEGRATION_PLAN.md)`);
             tradingMode = 'PAPER';
         }
-        // Validate trading mode vs credentials
-        if (tradingMode !== 'PAPER' && !exchangeConfig) {
-            logger.warn(TAG, `Trading mode ${tradingMode} requires exchange API keys — falling back to PAPER`);
-            tradingMode = 'PAPER';
+        // Validate trading mode vs credentials — PER VENUE (the credential SHAPES
+        // differ: Binance = apiKey/secret, Hyperliquid = master address + agent key).
+        if (tradingMode !== 'PAPER') {
+            if (venue === 'binance' && !exchangeConfig) {
+                logger.warn(TAG, `Trading mode ${tradingMode} requires exchange API keys — falling back to PAPER`);
+                tradingMode = 'PAPER';
+            }
+            else if (venue === 'hyperliquid' && !hlCredentials) {
+                logger.warn(TAG, `Trading mode ${tradingMode} on Hyperliquid requires exchange.walletAddress (master) + ` +
+                    'exchange.agentPrivateKey (agent wallet) — falling back to PAPER');
+                tradingMode = 'PAPER';
+            }
         }
         // Create a BinancePrivateApi for SHADOW mode balance reads whenever
         // credentials exist — even if we start in PAPER, the user can switch
@@ -1106,6 +1162,7 @@ const paperTradingPlugin = {
         // Read by the create_order tool below to dual-write proposals. See §12 of
         // docs/APPROVAL_MODE_DESIGN.md.
         let proposalManagerCtx;
+        let proposalListenerCredentials;
         // Approval mode read at init from env + plugin-config.json; passed to the
         // create_order tool so it picks the right branch (off / shadow / per_trade).
         let approvalModeForTool = 'off';
@@ -1232,6 +1289,7 @@ const paperTradingPlugin = {
                         manager: new ProposalManager({ baseUrl: ingestBaseUrl, ingestToken }),
                         userId: reefclawUserId,
                     };
+                    proposalListenerCredentials = { ingestToken, userId: reefclawUserId };
                     logger.info(TAG, `Approval wiring active (mode=${approvalModeForTool}) → ${ingestBaseUrl} (userId=${reefclawUserId.slice(0, 8)}…)`);
                 }
                 else if (approvalModeForTool !== 'off') {
@@ -1243,40 +1301,30 @@ const paperTradingPlugin = {
                 // args, identical behavior; the unsupported-venue arm is unreachable
                 // here because the isLiveVenueSupported() gate above already fell back
                 // to PAPER. Phase 3 adds the hyperliquid adapter inside the factory.
-                const liveAdapter = createLiveAdapter(venue, exchangeConfig, tradingMode, microLiveConfig, bracketMode, userDataStreamMode, userDataStreamTunables, tradeIngest, autoCapture);
-                adapter = liveAdapter;
-                // ---- Approval-mode Phase B — start ProposalDecisionListener ----
-                // Started only when approval.mode='per_trade' AND proposalManagerCtx
-                // is wired (creds present). The listener polls /pending-decisions and
-                // fires approved proposals via createOrderTool with proposalManager
-                // omitted — that path runs the real adapter.createOrder.
-                if (approvalModeForTool === 'per_trade' && proposalManagerCtx) {
-                    try {
-                        const approvalCfg = readPluginConfig().approval;
-                        let cfgForUrl;
-                        try {
-                            cfgForUrl = readPluginConfig();
-                        }
-                        catch {
-                            cfgForUrl = undefined;
-                        }
-                        const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForUrl);
-                        proposalDecisionListener = new ProposalDecisionListener({
-                            baseUrl: ingestBaseUrl,
-                            ingestToken: ingestToken,
-                            userId: reefclawUserId,
-                            adapter: liveAdapter,
-                            binanceApi,
-                            autoCapture,
-                            pollIntervalMs: approvalCfg?.pollIntervalMs ?? 3_000,
-                        });
-                        proposalDecisionListener.start();
-                        logger.info(TAG, `ProposalDecisionListener started (poll ${approvalCfg?.pollIntervalMs ?? 3_000} ms)`);
-                    }
-                    catch (err) {
-                        logger.warn(TAG, `Failed to start ProposalDecisionListener: ${String(err)}`);
+                const liveAdapter = createLiveAdapter(venue === 'hyperliquid'
+                    ? {
+                        venue: 'hyperliquid',
+                        args: {
+                            // Non-null by the per-venue credential gate above.
+                            credentials: hlCredentials,
+                            mode: tradingMode,
+                            marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
+                        },
                     }
-                }
+                    : {
+                        venue: 'binance',
+                        args: [
+                            exchangeConfig,
+                            tradingMode,
+                            microLiveConfig,
+                            bracketMode,
+                            userDataStreamMode,
+                            userDataStreamTunables,
+                            tradeIngest,
+                            autoCapture,
+                        ],
+                    });
+                adapter = liveAdapter;
                 // Reconciler-driven close-bypass cleanup. The reconciler emits
                 // 'drift_detected' on every poll; we filter for 'closed' drifts
                 // (position observed flat on exchange while local thinks it's open).
@@ -1440,10 +1488,10 @@ const paperTradingPlugin = {
             }
         }
         catch { /* best-effort — default applies */ }
+        const wave9OperationLock = new SerialTradingOperationLock();
         const bootstrapWatcher = stopWatcherIntervalMs !== undefined
-            ? new PositionWatcher(adapter, stopWatcherIntervalMs)
-            : new PositionWatcher(adapter);
-        bootstrapWatcher.start();
+            ? new PositionWatcher(adapter, stopWatcherIntervalMs, wave9OperationLock)
+            : new PositionWatcher(adapter, undefined, wave9OperationLock);
         // Paper-mode background market-data feed. Refreshes the simulator's marks
         // for every symbol with an open position/order (not just the dashboard
         // symbol), so the stop-watcher sees a fresh mark, NAV/uPnL stay live, and
@@ -1460,9 +1508,410 @@ const paperTradingPlugin = {
             simulator,
             stopWatcher: bootstrapWatcher,
             marketFeed,
+            operationLock: wave9OperationLock,
         });
         const intelDeps = { connectionToken, apiBaseUrl };
-        const intelApiDeps = { connectionToken, intelligenceUrl };
+        // venue rides the deps so every intel tool maps agent-facing symbols to
+        // the venue's intel namespace (plan §5.3) — absent/'binance' is
+        // byte-identical passthrough.
+        const intelApiDeps = { connectionToken, intelligenceUrl, venue };
+        const wave9AdmissionGuard = new Wave9PaperAdmissionGuard();
+        let wave9LiveLedger;
+        try {
+            wave9LiveLedger = new Wave9LiveExecutionLedger();
+        }
+        catch (error) {
+            // A malformed durable ledger must disable Wave 9 LIVE admission without
+            // taking unrelated trading and risk-reducing tools offline.
+            logger.error(TAG, `Wave 9 live execution ledger unavailable: ${formatError(error)}`);
+        }
+        const checkWave9LiveSymbolOwnership = async (symbol) => {
+            const ledger = wave9LiveLedger;
+            if (!ledger) {
+                return {
+                    status: 'unavailable',
+                    reason: 'durable_wave9_live_execution_ledger_unavailable',
+                };
+            }
+            return inspectWave9LiveSymbolOwnership(runtime.adapter, ledger, symbol);
+        };
+        if (wave9LiveLedger) {
+            const liveLedger = wave9LiveLedger;
+            const canonicalWave9Symbol = (symbol) => symbol.toUpperCase().replace(/[^A-Z0-9]/g, '').replace(/USDTUSDT$/, 'USDT');
+            const resolveSingleOpenOwner = (symbol) => {
+                const canonical = canonicalWave9Symbol(symbol);
+                const matches = liveLedger.getAll().filter((record) => record.state === 'open'
+                    && record.symbol === canonical);
+                if (matches.length > 1) {
+                    throw new Error(`multiple durable OPEN Wave 9 candidates own ${symbol}; refusing ambiguous lifecycle mutation`);
+                }
+                return matches[0];
+            };
+            const logWave9Recovery = (trigger, result) => {
+                if (result.status === 'flat') {
+                    logger.info(TAG, `Wave 9 LIVE ${trigger}: ${result.symbol} is stably flat and candidate ` +
+                        `${result.candidateId} is durably CLOSED (${result.detail})`);
+                }
+                else if (result.status === 'protected') {
+                    logger.warn(TAG, `Wave 9 LIVE ${trigger}: residual ${result.symbol} is protected by the exact ` +
+                        `frozen stop ${result.stopPrice} (${result.detail})`);
+                }
+                else {
+                    logger.error(TAG, `Wave 9 LIVE ${trigger}: ${result.detail}; candidate ${result.candidateId} ` +
+                        'remains durably OPEN');
+                }
+            };
+            const logWave9ReadyReconciliation = (trigger, result) => {
+                for (const row of result.rows) {
+                    const message = `Wave 9 LIVE ${trigger} reconciliation ${row.status} for ${row.symbol}/` +
+                        `${row.candidateId}: ${row.detail}`;
+                    if (row.status === 'protected')
+                        logger.info(TAG, message);
+                    else if (row.status === 'closed')
+                        logger.info(TAG, message);
+                    else
+                        logger.error(TAG, message);
+                }
+            };
+            const wave9DurableReconciliationScheduler = new Wave9LiveDurableReconciliationScheduler({
+                operationLock: wave9OperationLock,
+                isCurrentSource: (source) => runtime.mode === 'LIVE' && runtime.adapter === source,
+                reconcile: (source) => reconcileWave9LiveDurableRows(source, liveLedger),
+                onResult: logWave9ReadyReconciliation,
+                onError: (trigger, error) => {
+                    logger.error(TAG, `Wave 9 LIVE ${trigger} durable reconciliation failed: ${formatError(error)}; ` +
+                        'IMMEDIATE MANUAL INTERVENTION REQUIRED');
+                },
+            });
+            const handleProtectionLoss = (source, event) => wave9OperationLock.withAccountLock(`wave9_protection_loss:${event.symbol}`, async () => {
+                if (runtime.mode !== 'LIVE' || runtime.adapter !== source) {
+                    logger.warn(TAG, `Ignoring stale Wave 9 protection-loss event for ${event.symbol} from a replaced/non-LIVE adapter`);
+                    return;
+                }
+                const owner = resolveSingleOpenOwner(event.symbol);
+                if (!owner)
+                    return; // Generic/non-Wave9 bracket behavior stays unchanged.
+                if (event.entryClientOrderId !== owner.clientOrderId
+                    || event.entrySide !== owner.side) {
+                    throw new Error(`IMMEDIATE MANUAL INTERVENTION REQUIRED: ${event.symbol} protection-loss event ` +
+                        `belongs to entry ${event.entryClientOrderId}/${event.entrySide}, not durable ` +
+                        `Wave 9 owner ${owner.clientOrderId}/${owner.side}; refusing stale/generic mutation`);
+                }
+                const bracketLedger = source.getBracketLedger();
+                const row = bracketLedger?.getBySymbol(event.symbol);
+                if (row && (row.entryCid !== owner.clientOrderId || row.entrySide !== owner.side)) {
+                    throw new Error(`IMMEDIATE MANUAL INTERVENTION REQUIRED: ${event.symbol} has durable Wave 9 owner ` +
+                        `${owner.candidateId}, but its current bracket belongs to a different entry; ` +
+                        'refusing to auto-close or replace potentially generic protection');
+                }
+                if (row && row.bracketId !== event.bracketId) {
+                    logger.info(TAG, `Ignoring stale Wave 9 stop-loss event ${event.bracketId} for ${event.symbol}; ` +
+                        `current bracket is ${row.bracketId}`);
+                    return;
+                }
+                if (row?.slCid && event.stopClientOrderId && row.slCid !== event.stopClientOrderId) {
+                    logger.info(TAG, `Ignoring stale Wave 9 stop CID ${event.stopClientOrderId} for ${event.symbol}`);
+                    return;
+                }
+                let terminalStopProven = event.source !== 'reconciler_missing';
+                if (event.source === 'reconciler_missing' && event.stopClientOrderId) {
+                    const liveness = await source.resolveBracketLegLiveness(event.stopClientOrderId);
+                    if (liveness === 'live' || liveness === 'unknown') {
+                        logger.info(TAG, `Wave 9 reconciler reported ${event.symbol} stop missing, but exact CID ` +
+                            `${event.stopClientOrderId} is ${liveness}; deferring destructive recovery ` +
+                            'until terminal loss is proven');
+                        return;
+                    }
+                    terminalStopProven = liveness === 'terminal';
+                }
+                else if (event.source === 'reconciler_missing' && !event.stopClientOrderId) {
+                    // A stop was required by the row but no exact stop CID was ever
+                    // persisted or observed in the trusted open-order snapshot.
+                    terminalStopProven = true;
+                }
+                if (row && terminalStopProven
+                    && row.state !== 'cancelled'
+                    && row.state !== 'failed'
+                    && row.state !== 'triggered_sl'
+                    && row.state !== 'triggered_tp') {
+                    try {
+                        bracketLedger?.markState(event.symbol, 'cancelled', {
+                            closeReason: 'cancelled_auto',
+                            lastError: event.detail,
+                        });
+                    }
+                    catch (error) {
+                        logger.error(TAG, `Could not durably terminalize lost Wave 9 stop for ${event.symbol}: ${formatError(error)}; ` +
+                            'continuing to exact re-protection/emergency flatten');
+                    }
+                }
+                const result = await recoverWave9LiveExposure(source, liveLedger, owner.candidateId, event.symbol);
+                logWave9Recovery(event.source, result);
+            });
+            runtime.setWave9LiveLifecycleHooks({
+                configureLiveAdapter: (source) => {
+                    source.setWave9ProtectionLossHandler((event) => handleProtectionLoss(source, event));
+                    wave9DurableReconciliationScheduler.attach(source);
+                },
+                configurePositionWatcher: (watcher, source) => {
+                    wave9DurableReconciliationScheduler.stopIfSourceChanged(source);
+                    watcher.setWave9CloseLifecycle({
+                        resolveCandidateId: (position) => {
+                            if (!source.isLive || runtime.mode !== 'LIVE' || runtime.adapter !== source) {
+                                return undefined;
+                            }
+                            const owner = resolveSingleOpenOwner(position.symbol);
+                            if (!owner)
+                                return undefined;
+                            const expectedSide = owner.side === 'buy' ? 'long' : 'short';
+                            if (position.side !== expectedSide) {
+                                throw new Error(`durable Wave 9 owner ${owner.candidateId} is ${expectedSide}, but exchange position is ${position.side}`);
+                            }
+                            if (position.candidateId && position.candidateId !== owner.candidateId) {
+                                throw new Error(`position candidate ${position.candidateId} does not match durable owner ${owner.candidateId}`);
+                            }
+                            if (!position.candidateId) {
+                                if (!(source instanceof LiveAdapter)) {
+                                    throw new Error('candidate-bound native bracket proof is unavailable');
+                                }
+                                const bracket = source.getBracketLedger()?.getBySymbol(position.symbol);
+                                if (!bracket
+                                    || bracket.entryCid !== owner.clientOrderId
+                                    || bracket.entrySide !== owner.side) {
+                                    throw new Error(`native bracket ownership does not match durable Wave 9 owner ${owner.candidateId}`);
+                                }
+                            }
+                            return owner.candidateId;
+                        },
+                        settleAfterClose: async (candidateId, symbol) => {
+                            if (!source.isLive || runtime.mode !== 'LIVE' || runtime.adapter !== source) {
+                                const record = liveLedger.getByCandidateId(candidateId);
+                                return {
+                                    status: 'manual_intervention',
+                                    detail: 'IMMEDIATE MANUAL INTERVENTION REQUIRED: adapter changed during Wave 9 stop close recovery',
+                                    candidateId,
+                                    symbol,
+                                    stopPrice: record?.initialStop ?? Number.NaN,
+                                };
+                            }
+                            const result = await recoverWave9LiveExposure(source, liveLedger, candidateId, symbol);
+                            logWave9Recovery('stop_watcher', result);
+                            return result;
+                        },
+                    });
+                },
+            });
+        }
+        // Start only after the durable Wave 9 close lifecycle has been installed.
+        // If the ledger failed to load, Wave 9 admission is disabled and generic
+        // watcher behavior still starts normally here.
+        bootstrapWatcher.start();
+        // Start the approved-order listener only after runtime, the shared
+        // mutation lock, and durable Wave 9 ownership state are fully resolved.
+        if (runtime.adapter.isLive
+            && approvalModeForTool === 'per_trade'
+            && proposalManagerCtx
+            && proposalListenerCredentials) {
+            try {
+                const approvalCfg = readPluginConfig().approval;
+                let cfgForUrl;
+                try {
+                    cfgForUrl = readPluginConfig();
+                }
+                catch {
+                    cfgForUrl = undefined;
+                }
+                const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForUrl);
+                proposalDecisionListener = new ProposalDecisionListener({
+                    baseUrl: ingestBaseUrl,
+                    ingestToken: proposalListenerCredentials.ingestToken,
+                    userId: proposalListenerCredentials.userId,
+                    adapter: runtime.adapter,
+                    binanceApi,
+                    autoCapture,
+                    operationLock: wave9OperationLock,
+                    checkWave9LiveSymbolOwnership,
+                    pollIntervalMs: approvalCfg?.pollIntervalMs ?? 3_000,
+                });
+                proposalDecisionListener.start();
+                logger.info(TAG, `ProposalDecisionListener started (poll ${approvalCfg?.pollIntervalMs ?? 3_000} ms)`);
+            }
+            catch (err) {
+                logger.warn(TAG, `Failed to start ProposalDecisionListener: ${String(err)}`);
+            }
+        }
+        const wave9ActivationClient = new IntelWave9ActivationClient(intelApiDeps);
+        const getWave9AccountSnapshot = async () => {
+            if (!runtime.adapter.isLive) {
+                reloadState();
+                // Seed the generic daily-drawdown anchor before binding it into a
+                // Wave 9 fingerprint. Normal create_order keeps getSessionStartNav().
+                runtime.adapter.getSimulator().getSessionStartNav();
+                const capture = captureWave9PaperAccountSnapshot(runtime.adapter);
+                const quote = capture.snapshot.wallet.find((row) => row.currency === capture.snapshot.quoteCurrency);
+                const positions = capture.snapshot.positions.map((position) => {
+                    let positionFingerprint;
+                    try {
+                        positionFingerprint = captureWave9PaperPositionFingerprint(runtime.adapter, position.symbol).fingerprint;
+                    }
+                    catch {
+                        // Malformed or duplicate local geometry remains visible but cannot
+                        // receive a mechanical exit authorization.
+                    }
+                    const strategy = position.strategy === 'tsmom_28d_long_flat_reversal_1d'
+                        || position.strategy === 'tsmom_28d_short_flat_reversal_1d'
+                        ? position.strategy
+                        : undefined;
+                    return {
+                        symbol: position.symbol,
+                        side: position.side,
+                        quantity: position.quantity,
+                        entryPrice: position.entryPrice,
+                        markPrice: position.markPrice,
+                        ...(position.stopPrice !== null ? { stopPrice: position.stopPrice } : {}),
+                        ...(position.missionId ? { missionId: position.missionId } : {}),
+                        ...(position.setupType ? { setupType: position.setupType } : {}),
+                        ...(position.candidateId ? { candidateId: position.candidateId } : {}),
+                        ...(strategy ? { strategy } : {}),
+                        ...(position.accruedFundingUsd !== null
+                            ? { accruedFundingUsd: position.accruedFundingUsd }
+                            : {}),
+                        openedAt: position.openedAt,
+                        ...(positionFingerprint ? { positionFingerprint } : {}),
+                    };
+                });
+                return {
+                    tradingMode: runtime.mode,
+                    positionsAvailable: true,
+                    openOrdersAvailable: true,
+                    openOrderCount: capture.snapshot.openOrders.length,
+                    cashEquityAvailable: quote !== undefined && Number.isFinite(quote.total),
+                    ...(quote !== undefined && Number.isFinite(quote.total)
+                        ? { cashEquityUsd: quote.total }
+                        : {}),
+                    positions,
+                    executedCandidateIds: capture.snapshot.closedWave9CandidateIds,
+                    source: 'paper_simulator_wallet_positions_and_orders',
+                    accountFingerprint: capture.fingerprint,
+                    authoritative: false,
+                    runtimeParity: false,
+                    provenance: capture.provenance,
+                    reasons: [
+                        'cross_process_single_owner_lease_absent',
+                        'cross_process_lease_absent_duplicate_concurrent_admission_not_ruled_out',
+                        'market_mark_fingerprint_drift_requires_immediate_status_recall',
+                    ],
+                };
+            }
+            const nativeStopProtectionAvailable = runtime.mode === 'LIVE'
+                && runtime.adapter instanceof LiveAdapter
+                && bracketsEnabled(loadBracketMode())
+                && runtime.adapter.getBracketManager() !== null
+                && runtime.adapter.getBracketLedger() !== null;
+            if (runtime.mode === 'LIVE' && runtime.adapter.isLive && wave9LiveLedger) {
+                try {
+                    const capture = await captureWave9LiveAccount(runtime.adapter, wave9LiveLedger, 'LIVE');
+                    return {
+                        tradingMode: 'LIVE',
+                        positionsAvailable: true,
+                        openOrdersAvailable: true,
+                        openOrderCount: capture.pendingExposureOrderCount,
+                        cashEquityAvailable: true,
+                        cashEquityUsd: capture.cashEquityUsd,
+                        positions: capture.positions,
+                        executedCandidateIds: capture.executedCandidateIds,
+                        source: 'live_exchange_wallet_positions_orders_and_wave9_ledger',
+                        accountFingerprint: capture.fingerprint,
+                        authoritative: capture.authoritative,
+                        runtimeParity: false,
+                        provenance: capture.provenance,
+                        adapterReadiness: runtime.adapter.readiness,
+                        nativeStopProtectionAvailable: nativeStopProtectionAvailable && capture.nativeStopProtectionComplete,
+                        reasons: [
+                            'live_candidate_identity_uses_local_durable_execution_ledger',
+                            'cross_process_lease_absent_duplicate_concurrent_admission_not_ruled_out',
+                            'live_funding_is_not_attributed_per_wave9_position',
+                            ...capture.nativeStopIssues.map((issue) => `native_stop_issue:${issue}`),
+                        ],
+                    };
+                }
+                catch (error) {
+                    return {
+                        tradingMode: 'LIVE',
+                        positionsAvailable: false,
+                        openOrdersAvailable: false,
+                        cashEquityAvailable: false,
+                        positions: [],
+                        source: 'live_exchange_snapshot_unavailable',
+                        authoritative: false,
+                        runtimeParity: false,
+                        provenance: 'live_exchange_snapshot_unavailable',
+                        adapterReadiness: runtime.adapter.readiness,
+                        nativeStopProtectionAvailable,
+                        reasons: [`live_snapshot_failed:${formatError(error)}`],
+                    };
+                }
+            }
+            return {
+                tradingMode: runtime.mode,
+                positionsAvailable: false,
+                openOrdersAvailable: false,
+                cashEquityAvailable: false,
+                positions: [],
+                source: 'wave9_execution_runtime_unavailable',
+                authoritative: false,
+                runtimeParity: false,
+                provenance: 'wave9_execution_runtime_unavailable',
+                adapterReadiness: runtime.adapter.readiness,
+                nativeStopProtectionAvailable,
+                reasons: [
+                    wave9LiveLedger
+                        ? 'Wave 9 execution requires the current mode to be PAPER or an exact LIVE exchange runtime'
+                        : 'Wave 9 live execution ledger is unavailable',
+                ],
+            };
+        };
+        const captureWave9AccountFingerprint = async () => {
+            if (runtime.mode !== 'LIVE' || !runtime.adapter.isLive || !wave9LiveLedger) {
+                throw new Error('Wave 9 authoritative LIVE account capture is unavailable');
+            }
+            const capture = await captureWave9LiveAccount(runtime.adapter, wave9LiveLedger, 'LIVE');
+            return { fingerprint: capture.fingerprint };
+        };
+        const captureWave9PositionFingerprint = async (symbol) => {
+            if (runtime.mode !== 'LIVE' || !runtime.adapter.isLive || !wave9LiveLedger) {
+                throw new Error('Wave 9 authoritative LIVE position capture is unavailable');
+            }
+            return captureWave9LivePosition(runtime.adapter, wave9LiveLedger, 'LIVE', symbol);
+        };
+        const confirmWave9LiveStop = async (input) => {
+            if (runtime.mode !== 'LIVE' || !(runtime.adapter instanceof LiveAdapter))
+                return false;
+            const liveAdapter = runtime.adapter;
+            const bracketLedger = liveAdapter.getBracketLedger();
+            if (!bracketLedger || !liveAdapter.getBracketManager())
+                return false;
+            const deadline = Date.now() + 20_000;
+            while (Date.now() < deadline) {
+                if (runtime.mode !== 'LIVE' || runtime.adapter !== liveAdapter)
+                    return false;
+                const bracket = bracketLedger.getBySymbol(input.symbol);
+                if (bracket?.state === 'failed'
+                    || bracket?.state === 'cancelled'
+                    || bracket?.state === 'triggered_sl'
+                    || bracket?.state === 'triggered_tp')
+                    return false;
+                if (bracket && (bracket.entryCid !== input.entryClientOrderId
+                    || bracket.entrySide !== input.entrySide))
+                    return false;
+                if (bracket
+                    && (bracket.state === 'active' || bracket.state === 'partial')) {
+                    return confirmWave9LiveNativeStop(liveAdapter, input);
+                }
+                await new Promise((resolve) => setTimeout(resolve, 250));
+            }
+            return false;
+        };
         // Facts-out local signal service (step 5). Created ONLY when the operator
         // flips signals.evaluator to shadow/enforce in plugin-config — default
         // 'central' leaves the get_signals path byte-identical (no service, no SSE
@@ -1592,10 +2041,21 @@ const paperTradingPlugin = {
                 parameters: TOOL_PARAMS.create_order,
                 execute: async (_id, params) => jsonResult(await createOrderTool(params, {
                     ...adapterDeps,
+                    adapter: runtime.adapter,
                     autoCapture,
                     proposalManager: proposalManagerCtx?.manager,
                     userId: proposalManagerCtx?.userId,
                     approvalMode: approvalModeForTool,
+                    wave9AdmissionGuard,
+                    wave9ActivationCheck: () => wave9ActivationClient.getActivation(),
+                    refreshPaperState: reloadState,
+                    wave9TradingModeCheck: () => runtime.mode,
+                    wave9VenueCheck: () => venue,
+                    captureWave9AccountFingerprint,
+                    confirmWave9LiveStop,
+                    wave9LiveLedger,
+                    checkWave9LiveSymbolOwnership,
+                    operationLock: wave9OperationLock,
                 })),
             },
             {
@@ -1603,42 +2063,78 @@ const paperTradingPlugin = {
                 label: 'Cancel Order',
                 description: 'Cancel a single open order by its ID.',
                 parameters: TOOL_PARAMS.cancel_order,
-                execute: async (_id, params) => jsonResult(await cancelOrderTool(params, adapterDeps)),
+                execute: async (_id, params) => jsonResult(await cancelOrderTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    operationLock: wave9OperationLock,
+                    checkWave9LiveSymbolOwnership,
+                })),
             },
             {
                 name: 'cancel_all_orders',
                 label: 'Cancel All Orders',
                 description: 'Cancel all open orders, optionally filtered by symbol.',
                 parameters: TOOL_PARAMS.cancel_all_orders,
-                execute: async (_id, params) => jsonResult(await cancelAllOrdersTool(params, adapterDeps)),
+                execute: async (_id, params) => jsonResult(await cancelAllOrdersTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    operationLock: wave9OperationLock,
+                })),
             },
             {
                 name: 'close_position',
                 label: 'Close Position',
                 description: 'Close an open position at market price by creating an opposing market order.',
                 parameters: TOOL_PARAMS.close_position,
-                execute: async (_id, params) => jsonResult(await closePositionTool(params, { ...adapterDeps, autoCapture })),
+                execute: async (_id, params) => jsonResult(await closePositionTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    autoCapture,
+                    wave9AdmissionGuard,
+                    refreshPaperState: reloadState,
+                    wave9TradingModeCheck: () => runtime.mode,
+                    wave9VenueCheck: () => venue,
+                    captureWave9PositionFingerprint,
+                    wave9LiveLedger,
+                    checkWave9LiveSymbolOwnership,
+                    operationLock: wave9OperationLock,
+                })),
             },
             {
                 name: 'modify_stop',
                 label: 'Modify Stop',
                 description: 'Move the exchange-side stop-loss on an open live position. Atomic cancel-then-resubmit with automatic rollback. Live mode only; requires brackets.mode enabled.',
                 parameters: TOOL_PARAMS.modify_stop,
-                execute: async (_id, params) => jsonResult(await modifyStopTool(params, adapterDeps)),
+                execute: async (_id, params) => jsonResult(await modifyStopTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    operationLock: wave9OperationLock,
+                    checkWave9LiveSymbolOwnership,
+                })),
             },
             {
                 name: 'modify_target',
                 label: 'Modify Target',
                 description: 'Move the exchange-side take-profit on an open live position. Atomic cancel-then-resubmit with automatic rollback. Live mode only; requires brackets.mode enabled.',
                 parameters: TOOL_PARAMS.modify_target,
-                execute: async (_id, params) => jsonResult(await modifyTargetTool(params, adapterDeps)),
+                execute: async (_id, params) => jsonResult(await modifyTargetTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    operationLock: wave9OperationLock,
+                    checkWave9LiveSymbolOwnership,
+                })),
             },
             {
                 name: 'attach_brackets',
                 label: 'Attach Brackets',
                 description: 'Bootstrap exchange-side STOP_MARKET + TAKE_PROFIT_MARKET protection on an existing open live position that is currently naked. Use this to recover when a position exists without active brackets (e.g. after kill-switch stripped them or brackets failed to attach at entry). Rejects if brackets are already active for the symbol — use modify_stop / modify_target instead. Live mode only; requires brackets.mode enabled.',
                 parameters: TOOL_PARAMS.attach_brackets,
-                execute: async (_id, params) => jsonResult(await attachBracketsTool(params, adapterDeps)),
+                execute: async (_id, params) => jsonResult(await attachBracketsTool(params, {
+                    ...adapterDeps,
+                    adapter: runtime.adapter,
+                    operationLock: wave9OperationLock,
+                    checkWave9LiveSymbolOwnership,
+                })),
             },
             {
                 name: 'audit_bracket_protection',
@@ -1786,6 +2282,19 @@ const paperTradingPlugin = {
                 parameters: TOOL_PARAMS.get_signals,
                 execute: async (_id, params) => jsonResult(await getSignalsTool(params, getSignalsDeps)),
             },
+            {
+                name: 'get_wave9_status',
+                label: 'Get Wave 9 Status',
+                description: 'MANDATORY fresh call for every question about which strategies are active, usable, available, or tradeable now: never answer from memory; also call list_strategies fresh with active_only=true in the same turn. The operator reply MUST reproduce every line from requiredOperatorReport.lines exactly enough to preserve all labels, counts, and reasons. These are read-only status calls; the question alone does not authorize placing or closing an order or toggling a strategy. Return any single-use entry or reversal token. An empty token set means wait for the next valid signal/window; it does not disable LIVE trading. LIVE orders use real capital.',
+                parameters: TOOL_PARAMS.get_wave9_status,
+                execute: async () => jsonResult(await getWave9StatusTool({
+                    activationClient: wave9ActivationClient,
+                    getAccountSnapshot: getWave9AccountSnapshot,
+                    operationLock: wave9OperationLock,
+                    authorizationIssuer: wave9AdmissionGuard,
+                    executionVenue: venue,
+                })),
+            },
             {
                 name: 'get_analytics',
                 label: 'Get Edge Analytics',
@@ -1897,9 +2406,10 @@ const paperTradingPlugin = {
             {
                 name: 'list_strategies',
                 label: 'List Strategies',
-                description: 'List all strategies in the Strategy Box. Shows name, description, regime whitelist, conditions, active status, and whether it is a built-in strategy. Use to see which strategies are available for backtesting and live trading.',
+                description: 'MANDATORY for every question about which strategies are active, usable, available, or tradeable now: never answer from memory; call this tool fresh with active_only=true and also call get_wave9_status fresh in the same turn. The operator reply MUST reproduce every line from get_wave9_status.requiredOperatorReport.lines exactly enough to preserve all labels, counts, and reasons. List strategies in the Strategy Box with name, description, regime whitelist, conditions, active status, and whether each is built in. Active means the operator enabled the strategy; it does not mean an order is authorized this instant. These are read-only status calls; the question alone does not authorize placing or closing an order or toggling a strategy.',
                 parameters: TOOL_PARAMS.list_strategies,
-                execute: async (_id, params) => jsonResult(await listStrategiesTool(params ?? {}, intelApiDeps)),
+                prepareArguments: prepareListStrategiesArgs,
+                execute: async (_id, params) => jsonResult(await listStrategiesTool(prepareListStrategiesArgs(params), intelApiDeps)),
             },
             {
                 name: 'toggle_strategy',