@reefclaw/openclaw-plugin 0.1.5 → 0.1.7

package/bridge/gateway/event-parser.d.ts

@@ -170,8 +170,13 @@ export interface ParsedEvent<E extends ProviderEventName = ProviderEventName> {
 export declare class EventParser {
     /** Buffered assistant text per runId, with timestamps for expiry */
     private assistantBuffers;
-    /** Last decision timestamp (set on lifecycle 'start') */
+    /** Last decision timestamp (set on lifecycle 'end' of a non-errored run) */
     private lastDecisionTs;
+    /** Runs that emitted a lifecycle 'error' — their 'end' must NOT count as a
+     *  decision. Issue #194: bumping on 'start' kept "last decision" fresh
+     *  through an 18h all-models-failed outage, so the dashboard's 2×-interval
+     *  "unresponsive" rung could never fire. Bounded (oldest evicted). */
+    private erroredRuns;
     /** Error timestamps within the rolling window */
     private errorTimestamps;
     /** Symbol for balance currency extraction */

package/bridge/gateway/event-parser.js

@@ -417,8 +417,13 @@ const BUFFER_INACTIVITY_MS = 120_000; // 120 seconds — matches webapp streamin
 export class EventParser {
     /** Buffered assistant text per runId, with timestamps for expiry */
     assistantBuffers = new Map();
-    /** Last decision timestamp (set on lifecycle 'start') */
+    /** Last decision timestamp (set on lifecycle 'end' of a non-errored run) */
     lastDecisionTs = null;
+    /** Runs that emitted a lifecycle 'error' — their 'end' must NOT count as a
+     *  decision. Issue #194: bumping on 'start' kept "last decision" fresh
+     *  through an 18h all-models-failed outage, so the dashboard's 2×-interval
+     *  "unresponsive" rung could never fire. Bounded (oldest evicted). */
+    erroredRuns = new Set();
     /** Error timestamps within the rolling window */
     errorTimestamps = [];
     /** Symbol for balance currency extraction */
@@ -465,10 +470,15 @@ export class EventParser {
         }
         switch (phase) {
             case 'start':
-                this.lastDecisionTs = new Date().toISOString();
                 logger.debug(TAG, `Agent turn started: ${runId}`);
                 return [];
             case 'end': {
+                // A decision = a turn that ENDED without erroring. Bumping on 'start'
+                // (pre-#194) kept the timestamp fresh while every run failed, hiding
+                // an all-models-failed outage from the unresponsive heuristics.
+                if (!this.erroredRuns.delete(runId)) {
+                    this.lastDecisionTs = new Date().toISOString();
+                }
                 logger.debug(TAG, `Agent turn ended: ${runId}`);
                 return this.flushAssistantBuffer(runId);
             }
@@ -476,6 +486,13 @@ export class EventParser {
                 const errMsg = data.error ?? 'Unknown agent error';
                 logger.warn(TAG, `Agent error (run ${runId}): ${errMsg}`);
                 this.errorTimestamps.push(Date.now());
+                this.erroredRuns.add(runId);
+                // Bound the set: an errored run whose 'end' never arrives would leak.
+                if (this.erroredRuns.size > 100) {
+                    const oldest = this.erroredRuns.values().next().value;
+                    if (oldest !== undefined)
+                        this.erroredRuns.delete(oldest);
+                }
                 // Still flush the buffer — partial responses are better than nothing
                 return this.flushAssistantBuffer(runId);
             }

package/bridge/gateway/poller.d.ts

@@ -4,6 +4,7 @@ import type { TickerData, CandleData, OrderData, MarketStructureData, CryptoMetr
 export declare const TICKER_INTERVAL_MS = 5000;
 export declare const OHLCV_INTERVAL_MS = 15000;
 export declare const POSITIONS_INTERVAL_MS = 10000;
+export declare const OPEN_ORDERS_INTERVAL_MS = 60000;
 export declare const MARKET_STRUCTURE_INTERVAL_MS = 60000;
 /** CCXT position — minimal shape needed by poller */
 export interface CcxtPosition {

package/bridge/gateway/poller.js

@@ -25,7 +25,17 @@ export const OHLCV_INTERVAL_MS = 15_000;
 // startup handshake is extra live-system surface area for no extra weight.
 export const POSITIONS_INTERVAL_MS = 10_000;
 const BALANCE_INTERVAL_MS = 10_000;
-const OPEN_ORDERS_INTERVAL_MS = 3_000;
+// 2026-07-21: 3s → 60s, and the poll is now UNSCOPED (no symbol filter). Its
+// only consumer is the fallback cache behind Kill and the reconcile snapshot
+// (no event emission — live order updates ride the WS stream), and both of
+// those are portfolio-wide by contract: a { symbol }-scoped cache silently
+// degraded them to one symbol whenever the fresh all-symbol fetch failed.
+// Unscoped fetchOpenOrders costs Binance weight 80 (regular + algo merged) vs
+// 2 scoped, so the cadence drops to 60s (80/min, vs 40/min before; the old 3s
+// cadence unscoped would be 1600/min ≈ the whole ceiling). Matches the
+// plugin's own 60s algo-refresh; in userDataStream enforce mode the read is
+// served from the WS store at zero REST weight anyway.
+export const OPEN_ORDERS_INTERVAL_MS = 60_000;
 // 2026-05-15: 30s → 60s. get_market_structure fetches SIX timeframes of
 // OHLCV per poll (the heaviest single skill poll). Multi-timeframe trend
 // structure does not meaningfully change in 30s; 60s keeps the Agent-State
@@ -357,7 +367,9 @@ export class Poller {
     }
     async pollOpenOrders() {
         const tool = this.toolMap.fetch_open_orders;
-        const result = await this.http.invoke(tool, { symbol: this.symbol });
+        // Fetch ALL open orders (no symbol filter) — this cache is the fallback
+        // for the portfolio-wide Kill + reconcile snapshot (see interval comment).
+        const result = await this.http.invoke(tool, {});
         const orders = [];
         if (Array.isArray(result.data)) {
             for (const ccxt of result.data) {

package/bridge/providers/gateway.d.ts

@@ -61,6 +61,18 @@ export declare class GatewayProvider implements OpenClawProvider {
     /** Track whether we've received at least one balance poll (needed for equity calculation). */
     private hasReceivedBalance;
     private readonly quoteCurrency;
+    /** issue #213 RED-zone debounce: consecutive RED evaluations + when the
+     *  streak began + when the position snapshot last refreshed. A RED verdict
+     *  must PERSIST and SURVIVE a positions refresh before auto-flatten fires —
+     *  in paper mode the wallet drops by FULL NOTIONAL at open, so a balance
+     *  poll landing before the new position reaches the snapshot reads the
+     *  entry's own notional as a phantom drawdown (observed live: a 38%-of-NAV
+     *  entry reported as a -38.41% RED zone 2s after its fill and was
+     *  auto-flattened). A race artifact cannot outlive one positions poll; a
+     *  real drawdown easily persists. */
+    private redZoneStreak;
+    private redZoneSince;
+    private positionsUpdatedAt;
     private orderTimestamps;
     private cancelTimestamps;
     private agentStateInterval;
@@ -301,8 +313,16 @@ export declare class GatewayProvider implements OpenClawProvider {
      */
     private reportTradeResult;
     /**
-     * Seed lastTradeTs from Intelligence API on startup. One-shot, best-effort.
-     * Prevents "Last Trade: Never" after every restart when the agent is flat.
+     * Seed lastTradeTs from the webapp's exchange-keyed fills ledger on startup.
+     * One-shot, best-effort. Prevents "Last Trade: Never" after every restart
+     * when the agent is flat.
+     *
+     * ★ Issue #194: the previous seed read intel's `trade_results` (closed
+     * round-trips only, single-symbol), which showed "last trade 365h ago"
+     * while the fills ledger had fills from the previous evening. The ledger
+     * (`GET /api/internal/trades`) is the source of truth for fills — seed from
+     * it, filtered to the current trading book. On any failure leave null:
+     * truthful-unknown beats confidently-wrong.
      */
     private seedLastTradeTs;
     /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */

package/bridge/providers/gateway.js

@@ -154,6 +154,18 @@ export class GatewayProvider {
     /** Track whether we've received at least one balance poll (needed for equity calculation). */
     hasReceivedBalance = false;
     quoteCurrency;
+    /** issue #213 RED-zone debounce: consecutive RED evaluations + when the
+     *  streak began + when the position snapshot last refreshed. A RED verdict
+     *  must PERSIST and SURVIVE a positions refresh before auto-flatten fires —
+     *  in paper mode the wallet drops by FULL NOTIONAL at open, so a balance
+     *  poll landing before the new position reaches the snapshot reads the
+     *  entry's own notional as a phantom drawdown (observed live: a 38%-of-NAV
+     *  entry reported as a -38.41% RED zone 2s after its fill and was
+     *  auto-flattened). A race artifact cannot outlive one positions poll; a
+     *  real drawdown easily persists. */
+    redZoneStreak = 0;
+    redZoneSince = 0;
+    positionsUpdatedAt = 0;
     // ---- Rate tracking ----
     orderTimestamps = [];
     cancelTimestamps = [];
@@ -658,6 +670,7 @@ export class GatewayProvider {
         }
         // Update internal state with fresh data (poller may be paused during reconnect)
         this.positions = positions;
+        this.positionsUpdatedAt = Date.now();
         this.balance = balance;
         this.openOrders = openOrders;
         // Compute current NAV for portfolio percent calculation (consistent with computeRiskMetrics)
@@ -1201,6 +1214,7 @@ export class GatewayProvider {
             }
         }
         this.positions = positions;
+        this.positionsUpdatedAt = Date.now();
         this.hasReceivedPositions = true;
         this.trySetSessionStartNav();
         this.emitRiskUpdate();
@@ -1890,10 +1904,32 @@ export class GatewayProvider {
         //     physically impossible under normal market conditions on a bracketed
         //     account. If the math says worse than that, it's bad data — log loudly
         //     and skip instead of closing real positions on a calculation error.
+        //  4. Persistence debounce (issue #213): the balance poll and the position
+        //     snapshot are not atomic. In PAPER mode the simulator deducts FULL
+        //     NOTIONAL from the wallet at open, so in the seconds after a fill the
+        //     wallet already reflects the deduction while `this.positions` does not
+        //     yet contain the new position — equity spuriously drops by exactly the
+        //     entry's notional and any entry >2.5% of NAV reads as a RED drawdown
+        //     (observed live: -38.41% reported 2s after a 38%-of-NAV entry; the
+        //     just-opened position was auto-flattened). A RED verdict therefore
+        //     only licenses the flatten once it (a) persists across REQUIRED_STREAK
+        //     consecutive evaluations, (b) has been standing MIN_RED_PERSISTENCE_MS,
+        //     and (c) has SURVIVED at least one positions refresh since it began —
+        //     the race artifact cannot outlive one positions poll (~10s), while a
+        //     real -2.5% drawdown trivially persists 25s. Cost on a real event:
+        //     the flatten fires ~25-35s later. Cost of a false one: a closed
+        //     position, a rejected-orders window, and a corrupted trading record.
         const uptimeMs = Date.now() - this.startedAt;
         const STARTUP_GRACE_PERIOD_MS = 30_000;
         const IMPOSSIBLE_DRAWDOWN = -0.5;
+        const REQUIRED_RED_STREAK = 3;
+        const MIN_RED_PERSISTENCE_MS = 25_000;
         if (metrics.drawdownZone === 'RED' && this.agentMode === 'ACTIVE') {
+            if (this.redZoneStreak === 0)
+                this.redZoneSince = Date.now();
+            this.redZoneStreak++;
+            const redForMs = Date.now() - this.redZoneSince;
+            const survivedPositionsRefresh = this.positionsUpdatedAt > this.redZoneSince;
             if (uptimeMs < STARTUP_GRACE_PERIOD_MS) {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) but within startup grace period (${Math.round(uptimeMs / 1000)}s) — skipping auto-flatten`);
             }
@@ -1903,6 +1939,11 @@ export class GatewayProvider {
             else if (metrics.utilization.dailyDrawdown < IMPOSSIBLE_DRAWDOWN) {
                 logger.error(TAG, `RED zone drawdown ${(metrics.utilization.dailyDrawdown * 100).toFixed(1)}% exceeds sanity floor ${IMPOSSIBLE_DRAWDOWN * 100}% — refusing auto-flatten, likely equity calculation error (balance.total=${this.balance.total}, sessionStartNav=${this.sessionStartNav}, positions=${this.positions.length})`);
             }
+            else if (this.redZoneStreak < REQUIRED_RED_STREAK ||
+                redForMs < MIN_RED_PERSISTENCE_MS ||
+                !survivedPositionsRefresh) {
+                logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — deferring auto-flatten until the verdict persists (streak ${this.redZoneStreak}/${REQUIRED_RED_STREAK}, ${Math.round(redForMs / 1000)}s/${MIN_RED_PERSISTENCE_MS / 1000}s, survivedPositionsRefresh=${survivedPositionsRefresh}). A fresh entry's notional reads as phantom drawdown until the position snapshot catches up (issue #213); a real drawdown will persist and flatten on a later evaluation.`);
+            }
             else {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — auto-flattening all positions`);
                 // Route through executeEmergency (NOT executeFlatten directly) so the
@@ -1917,6 +1958,11 @@ export class GatewayProvider {
                 });
             }
         }
+        else {
+            // Any non-RED evaluation clears the streak — the race artifact resolves
+            // the moment the positions snapshot includes the new position.
+            this.redZoneStreak = 0;
+        }
         // Include position snapshots + balance in risk_update so the webapp can
         // update KPI/PnL without depending on market_data ticker events.
         const equity = this.computeEquity();
@@ -2097,27 +2143,39 @@ export class GatewayProvider {
         this.inFlightReports.push(report);
     }
     /**
-     * Seed lastTradeTs from Intelligence API on startup. One-shot, best-effort.
-     * Prevents "Last Trade: Never" after every restart when the agent is flat.
+     * Seed lastTradeTs from the webapp's exchange-keyed fills ledger on startup.
+     * One-shot, best-effort. Prevents "Last Trade: Never" after every restart
+     * when the agent is flat.
+     *
+     * ★ Issue #194: the previous seed read intel's `trade_results` (closed
+     * round-trips only, single-symbol), which showed "last trade 365h ago"
+     * while the fills ledger had fills from the previous evening. The ledger
+     * (`GET /api/internal/trades`) is the source of truth for fills — seed from
+     * it, filtered to the current trading book. On any failure leave null:
+     * truthful-unknown beats confidently-wrong.
      */
     async seedLastTradeTs() {
         if (this.lastTradeTs)
             return; // Already set (e.g. from WS event during init)
-        const url = this.config.intelligenceUrl;
         const token = this.config.connectionToken;
-        if (!url || !token)
+        if (!token)
             return;
+        // www is load-bearing: reefclaw.com 307-redirects and Node fetch strips
+        // the Authorization header on cross-origin redirect (same as bridge.ts).
+        const base = (process.env.REEFCLAW_API_URL || 'https://www.reefclaw.com').replace(/\/$/, '');
+        const mode = this.tradingMode === 'PAPER' ? 'paper' : 'live';
         try {
-            const res = await fetch(`${url}/api/analytics/${this.config.symbol.replace('/', '')}/trades?limit=1`, {
+            const res = await fetch(`${base}/api/internal/trades?limit=1&mode=${mode}`, {
                 headers: { Authorization: `Bearer ${token}` },
                 signal: AbortSignal.timeout(5_000),
             });
             if (!res.ok)
                 return;
-            const trades = await res.json();
-            if (trades.length > 0 && trades[0].timestamp) {
-                this.lastTradeTs = trades[0].timestamp;
-                logger.info(TAG, `Seeded lastTradeTs from Intelligence: ${this.lastTradeTs}`);
+            const body = (await res.json());
+            const ts = body.trades?.[0]?.fillTimestamp;
+            if (ts) {
+                this.lastTradeTs = ts;
+                logger.info(TAG, `Seeded lastTradeTs from trades ledger (${mode}): ${this.lastTradeTs}`);
                 this.emitAgentState(); // Re-emit with updated timestamp
             }
         }

package/ccxt/binance-private.d.ts

@@ -1,4 +1,5 @@
 import type { CcxtOrder, CcxtBalance, CcxtPosition, CcxtTicker, ExchangeConfig } from '../types.js';
+import type { ClientOrderResolution } from '../exchange-adapter.js';
 import type { OrderBookDepth } from '../simulator/types.js';
 /** Result of API permission validation. */
 export interface PermissionCheckResult {
@@ -7,6 +8,18 @@ export interface PermissionCheckResult {
     canTrade: boolean;
     errors: string[];
 }
+/** Exact, weight-1 proof returned by Binance's per-clientAlgoId endpoint. */
+export interface BinanceAlgoOrderProof {
+    algoId: string | null;
+    clientAlgoId: string;
+    algoStatus: string;
+    symbol: string | null;
+    side: 'buy' | 'sell' | null;
+    orderType: string | null;
+    triggerPrice: number | null;
+    quantity: number | null;
+    closePosition: boolean | null;
+}
 export declare class BinancePrivateApi {
     private exchange;
     private testnet;
@@ -154,6 +167,12 @@ export declare class BinancePrivateApi {
      *  because "I was rate-limited" is just another flavour of "no answer").
      *  Ships dark in Phase 1 — no call sites yet. */
     queryAlgoOrderStatus(clientAlgoId: string): Promise<string | null>;
+    /**
+     * Fetch the full exchange shape for one exact conditional order. Unlike the
+     * broad open-algo snapshot, this endpoint is immediately usable after
+     * placement and is keyed by the stop's unique clientAlgoId.
+     */
+    queryAlgoOrderProof(clientAlgoId: string): Promise<BinanceAlgoOrderProof | null>;
     /** Fetch historical fills (trades) for a symbol via GET /fapi/v1/userTrades.
      *  Used by the REST gap-filler (rest-gap-filler.ts) to backfill any fills
      *  that landed during a WS blind window — when the user-data stream was
@@ -214,6 +233,8 @@ export declare class BinancePrivateApi {
      * after network timeouts — check if the order went through before retrying.
      */
     fetchOrderByClientId(clientOrderId: string, symbol: string): Promise<CcxtOrder | null>;
+    /** Resolve a deterministic client id without treating read failures as absence. */
+    resolveOrderByClientId(clientOrderId: string, symbol: string): Promise<ClientOrderResolution>;
     /** Cancel a real order on the exchange. Binance Futures splits orders across
      *  two endpoints — regular (`/fapi/v1/order`) and algo/conditional
      *  (`/fapi/v1/algoOrder`). Bracket SL/TP live in the algo bucket.

package/ccxt/binance-private.js

@@ -682,6 +682,68 @@ export class BinancePrivateApi {
             return null;
         }
     }
+    /**
+     * Fetch the full exchange shape for one exact conditional order. Unlike the
+     * broad open-algo snapshot, this endpoint is immediately usable after
+     * placement and is keyed by the stop's unique clientAlgoId.
+     */
+    async queryAlgoOrderProof(clientAlgoId) {
+        if (!clientAlgoId)
+            return null;
+        try {
+            assertNotBanned('queryAlgoOrder');
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const ex = this.exchange;
+            if (typeof ex.fapiPrivateGetAlgoOrder !== 'function')
+                return null;
+            const raw = await ex.fapiPrivateGetAlgoOrder({ clientAlgoId });
+            noteSuccess();
+            let row;
+            if (Array.isArray(raw)) {
+                row = raw
+                    .find((item) => String(item.clientAlgoId ?? '') === clientAlgoId);
+            }
+            else if (raw && typeof raw === 'object') {
+                const candidate = raw;
+                if (String(candidate.clientAlgoId ?? '') === clientAlgoId)
+                    row = candidate;
+            }
+            if (!row)
+                return null;
+            const algoStatus = String(row.algoStatus ?? '').trim().toUpperCase();
+            if (!algoStatus)
+                return null;
+            const sideValue = String(row.side ?? '').trim().toLowerCase();
+            const side = sideValue === 'buy' || sideValue === 'sell' ? sideValue : null;
+            const triggerPriceValue = Number(row.triggerPrice);
+            const quantityValue = Number(row.quantity);
+            const closePositionValue = row.closePosition;
+            const closePosition = closePositionValue === true
+                || String(closePositionValue).toLowerCase() === 'true'
+                ? true
+                : closePositionValue === false || String(closePositionValue).toLowerCase() === 'false'
+                    ? false
+                    : null;
+            return {
+                algoId: row.algoId == null ? null : String(row.algoId),
+                clientAlgoId,
+                algoStatus,
+                symbol: row.symbol == null ? null : String(row.symbol),
+                side,
+                orderType: row.orderType == null ? null : String(row.orderType).toUpperCase(),
+                triggerPrice: Number.isFinite(triggerPriceValue) && triggerPriceValue > 0
+                    ? triggerPriceValue
+                    : null,
+                quantity: Number.isFinite(quantityValue) && quantityValue >= 0 ? quantityValue : null,
+                closePosition,
+            };
+        }
+        catch (err) {
+            noteBinanceError(err);
+            logger.warn(TAG, `queryAlgoOrderProof(${clientAlgoId}) → null/unknown (NOT a verdict): ${formatError(err)}`);
+            return null;
+        }
+    }
     /** Fetch historical fills (trades) for a symbol via GET /fapi/v1/userTrades.
      *  Used by the REST gap-filler (rest-gap-filler.ts) to backfill any fills
      *  that landed during a WS blind window — when the user-data stream was
@@ -831,6 +893,9 @@ export class BinancePrivateApi {
             timestamp: raw.timestamp ?? Date.now(),
             datetime: raw.datetime ?? new Date().toISOString(),
             timeInForce: raw.timeInForce ?? 'GTC',
+            ...(typeof raw.clientOrderId === 'string' && raw.clientOrderId.length > 0
+                ? { clientOrderId: raw.clientOrderId }
+                : {}),
         };
     }
     /** Fetch a single order by ID. Used for fill polling and idempotency checks. */
@@ -871,39 +936,84 @@ export class BinancePrivateApi {
      * after network timeouts — check if the order went through before retrying.
      */
     async fetchOrderByClientId(clientOrderId, symbol) {
+        const resolution = await this.resolveOrderByClientId(clientOrderId, symbol);
+        return resolution.status === 'found' ? resolution.order : null;
+    }
+    /** Resolve a deterministic client id without treating read failures as absence. */
+    async resolveOrderByClientId(clientOrderId, symbol) {
         try {
-            // Pre-gate: never hammer Binance during a ban. Caveat: during a ban
-            // this returns null (= "not found"), so an idempotency caller could
-            // resubmit. Accepted tradeoff — extending the IP ban for everyone is
-            // worse, and the resubmit path is itself reduce-only/bounded.
+            // Never hammer Binance during a ban. A blocked read is caught below as
+            // UNKNOWN, so it can never authorize a resubmission.
             assertNotBanned('fetchOrder');
             const raw = await this.exchange.fetchOrder(undefined, symbol, {
                 origClientOrderId: clientOrderId,
             });
             noteSuccess();
+            const canonicalSymbol = (value) => value.toUpperCase().replace(/[^A-Z0-9]/g, '').replace(/USDTUSDT$/, 'USDT');
+            const rawId = raw?.id === undefined || raw?.id === null ? '' : String(raw.id);
+            const amount = raw?.amount;
+            const filled = raw?.filled;
+            const remaining = raw?.remaining;
+            if (!raw
+                || rawId.length === 0
+                || rawId.length > 512
+                || rawId.trim() !== rawId
+                || raw.clientOrderId !== clientOrderId
+                || typeof raw.symbol !== 'string'
+                || raw.symbol.length === 0
+                || canonicalSymbol(raw.symbol) !== canonicalSymbol(symbol)
+                || (raw.side !== 'buy' && raw.side !== 'sell')
+                || (raw.type !== 'market' && raw.type !== 'limit')
+                || (raw.status !== 'open' && raw.status !== 'closed' && raw.status !== 'canceled')
+                || typeof amount !== 'number'
+                || !Number.isFinite(amount)
+                || amount <= 0
+                || typeof filled !== 'number'
+                || !Number.isFinite(filled)
+                || filled < 0
+                || filled > amount + 1e-9 * Math.max(1, amount)
+                || typeof remaining !== 'number'
+                || !Number.isFinite(remaining)
+                || remaining < 0
+                || remaining > amount + 1e-9 * Math.max(1, amount)) {
+                return { status: 'unknown', detail: 'exchange returned a malformed client-order lookup response' };
+            }
             return {
-                id: String(raw.id),
-                symbol: raw.symbol ?? symbol,
-                side: (raw.side ?? 'buy'),
-                type: (raw.type ?? 'limit'),
-                status: raw.status,
-                amount: raw.amount ?? 0,
-                filled: raw.filled ?? 0,
-                remaining: raw.remaining ?? 0,
-                average: raw.average ?? null,
-                price: raw.price ?? null,
-                cost: raw.cost ?? 0,
-                fee: raw.fee ?? { cost: 0, currency: 'USDT' },
-                timestamp: raw.timestamp ?? Date.now(),
-                datetime: raw.datetime ?? new Date().toISOString(),
-                timeInForce: raw.timeInForce ?? 'GTC',
+                status: 'found',
+                order: {
+                    id: rawId,
+                    symbol: raw.symbol,
+                    side: raw.side,
+                    type: raw.type,
+                    status: raw.status,
+                    amount,
+                    filled,
+                    remaining,
+                    average: raw.average ?? null,
+                    price: raw.price ?? null,
+                    cost: raw.cost ?? 0,
+                    fee: raw.fee ?? { cost: 0, currency: 'USDT' },
+                    timestamp: raw.timestamp ?? Date.now(),
+                    datetime: raw.datetime ?? new Date().toISOString(),
+                    timeInForce: raw.timeInForce ?? 'GTC',
+                    clientOrderId: raw.clientOrderId,
+                    ...(raw.info && typeof raw.info === 'object' ? { info: raw.info } : {}),
+                },
             };
         }
         catch (err) {
             noteBinanceError(err);
-            // Order not found is expected when checking idempotency — don't log as error
-            logger.info(TAG, `fetchOrderByClientId(${clientOrderId}) not found or failed: ${formatError(err)}`);
-            return null;
+            const candidate = err;
+            const message = formatError(err);
+            const messageCode = message.match(/"code"\s*:\s*(-?\d+)/)?.[1];
+            const directCode = typeof candidate?.code === 'number' ? candidate.code : undefined;
+            const code = directCode ?? (messageCode ? Number(messageCode) : undefined);
+            if (code === -2013) {
+                logger.info(TAG, `resolveOrderByClientId(${clientOrderId}) confirmed absent (-2013)`);
+                return { status: 'confirmed_absent' };
+            }
+            logger.warn(TAG, `resolveOrderByClientId(${clientOrderId}) outcome unknown: ${message}`);
+            return { status: 'unknown', detail: message };
         }
     }
     /** Cancel a real order on the exchange. Binance Futures splits orders across

package/ccxt/public-market-data-api.d.ts

@@ -9,4 +9,18 @@ export interface PublicMarketDataApi {
     fetchOrderBook(symbol: string, limit?: number): Promise<OrderBookDepth | null>;
     fetchOHLCV(symbol: string, timeframe?: string, limit?: number): Promise<CcxtOHLCV[] | null>;
 }
+/** Which exchange serves the public market-data tools (fetch_ticker,
+ *  fetch_ohlcv, get_orderbook, get_market_structure, …).
+ *
+ *  The configured VENUE decides, in BOTH books — a hyperliquid venue must
+ *  never read Binance prices (live included: the agent would be running
+ *  technical analysis on the wrong exchange's data while trading real money
+ *  on HL). The intel price relay is a Binance-venue, paper-only escape hatch
+ *  for 451-geo-blocked hosts. */
+export declare function resolveMarketDataSource(opts: {
+    venue: 'binance' | 'hyperliquid';
+    isLive: boolean;
+    paperDataSource: 'binance' | 'intel';
+    hasConnectionToken: boolean;
+}): 'hyperliquid' | 'intel' | 'binance';
 export {};

package/ccxt/public-market-data-api.js

@@ -6,4 +6,18 @@
 // Deliberately EXCLUDES probeReachability: that is Binance-specific and only
 // the readiness reporter uses it — it must always probe the REAL Binance host
 // to detect the 451, so it keeps a concrete BinancePublicApi, never this.
-export {};
+/** Which exchange serves the public market-data tools (fetch_ticker,
+ *  fetch_ohlcv, get_orderbook, get_market_structure, …).
+ *
+ *  The configured VENUE decides, in BOTH books — a hyperliquid venue must
+ *  never read Binance prices (live included: the agent would be running
+ *  technical analysis on the wrong exchange's data while trading real money
+ *  on HL). The intel price relay is a Binance-venue, paper-only escape hatch
+ *  for 451-geo-blocked hosts. */
+export function resolveMarketDataSource(opts) {
+    if (opts.venue === 'hyperliquid')
+        return 'hyperliquid';
+    if (!opts.isLive && opts.paperDataSource === 'intel' && opts.hasConnectionToken)
+        return 'intel';
+    return 'binance';
+}

package/config/plugin-config-io.d.ts

@@ -40,6 +40,12 @@ export interface PluginConfigFile {
      *  carry `venue` through or it resets to the binance default. */
     exchange?: ExchangeConfig;
     tradingMode?: TradingMode;
+    /** Hyperliquid-specific knobs (Phase 3). `marketSlippagePct` bounds the IOC
+     *  "market" order — HL has no native market order, and ccxt's 5% default is far
+     *  too loose to ever rely on. Clamped to ≤2% adapter-side. */
+    hl?: {
+        marketSlippagePct?: number;
+    };
     microLive?: {
         sizeCapPercent?: number;
         maxPositionUSDT?: number;
@@ -189,6 +195,13 @@ export interface PluginConfigFile {
     [extra: string]: unknown;
 }
 export declare function defaultConfigPath(): string;
+/** Best-effort read of the operator's stop-watcher cadence override
+ *  (`stopWatcher.intervalMs`). Undefined (default applies) unless the config
+ *  holds a finite positive number. Read at every watcher CONSTRUCTION — boot
+ *  AND runtime reconnects — so a mode/credential swap can't silently revert
+ *  the override to the default (same read-at-build-time pattern as
+ *  loadBracketMode). */
+export declare function loadStopWatcherIntervalMs(path?: string): number | undefined;
 /** Read the config file. Returns `{}` if the file doesn't exist.
  *  Throws if the file exists but is unreadable or not valid JSON — callers
  *  should treat that as an abort signal, not silently overwrite. */

package/config/plugin-config-io.js

@@ -38,6 +38,21 @@ export function readOpenClawConnection() {
 export function defaultConfigPath() {
     return join(homedir(), '.reefclaw', 'plugin-config.json');
 }
+/** Best-effort read of the operator's stop-watcher cadence override
+ *  (`stopWatcher.intervalMs`). Undefined (default applies) unless the config
+ *  holds a finite positive number. Read at every watcher CONSTRUCTION — boot
+ *  AND runtime reconnects — so a mode/credential swap can't silently revert
+ *  the override to the default (same read-at-build-time pattern as
+ *  loadBracketMode). */
+export function loadStopWatcherIntervalMs(path) {
+    try {
+        const swMs = readPluginConfig(path).stopWatcher?.intervalMs;
+        if (typeof swMs === 'number' && Number.isFinite(swMs) && swMs > 0)
+            return swMs;
+    }
+    catch { /* best-effort — default applies */ }
+    return undefined;
+}
 /** Read the config file. Returns `{}` if the file doesn't exist.
  *  Throws if the file exists but is unreadable or not valid JSON — callers
  *  should treat that as an abort signal, not silently overwrite. */

package/config/tool-gate.js

@@ -17,6 +17,9 @@ export const UNGOVERNABLE_TOOLS = new Set([
     // Core safety floor — protecting/exiting positions and the review capture.
     'create_order',
     'close_position',
+    // Reversal capabilities for existing Wave 9 positions come only from this
+    // status path, so central tool preferences must never disable it.
+    'get_wave9_status',
     'modify_stop',
     'attach_brackets',
     'audit_bracket_protection',

package/exchange-adapter.d.ts

@@ -1,5 +1,15 @@
 import type { CcxtOrder, CcxtBalance, CcxtPosition, TradingMode } from './types.js';
 import type { PositionMetadata, CloseReason } from './simulator/types.js';
+/** Deterministic client-order lookup used after an outcome-ambiguous submit. */
+export type ClientOrderResolution = {
+    status: 'found';
+    order: CcxtOrder;
+} | {
+    status: 'confirmed_absent';
+} | {
+    status: 'unknown';
+    detail: string;
+};
 /** Adapter readiness state machine: INIT_PENDING → READY | DEGRADED | BLOCKED */
 export type AdapterReadiness = 'INIT_PENDING' | 'READY' | 'DEGRADED' | 'BLOCKED';
 /** Options for order submission. */
@@ -42,6 +52,12 @@ export interface IExchangeAdapter {
     getPositionsOrNull(symbol?: string): Promise<CcxtPosition[] | null>;
     getOpenOrders(symbol?: string): Promise<CcxtOrder[]>;
     fetchOrder(orderId: string, symbol?: string): Promise<CcxtOrder | null>;
+    /**
+     * A null-style fetch is unsafe for entry recovery because network/auth/rate
+     * failures are not proof an order was absent. Live adapters expose this
+     * tri-state resolver; paper adapters may omit it.
+     */
+    resolveOrderByClientId?(clientOrderId: string, symbol: string): Promise<ClientOrderResolution>;
     getLastPrice(symbol: string): Promise<number | null>;
     readonly readiness: AdapterReadiness;
     readonly mode: TradingMode;