@reefclaw/openclaw-plugin 0.1.5 → 0.1.7

package/live/live-adapter.js

@@ -22,9 +22,11 @@ import { BracketReconciler } from './bracket-reconciler.js';
 import { LiveBracketApi } from './live-bracket-api.js';
 import { generateBracketId, buildBracketCid, parseBracketCid } from './bracket-id.js';
 import { validateStopDirection, validateTargetDirection } from './bracket-params.js';
+import { fillPriceFromOrder } from './fill-price.js';
 import { bracketsEnabled } from '../config/brackets-config.js';
 import { userDataStreamEnabled, userDataStreamAuthoritative, DEFAULT_TUNABLES as USER_DATA_STREAM_DEFAULT_TUNABLES, } from '../config/user-data-stream-config.js';
 import { UserDataStreamController } from './user-data-stream-controller.js';
+import { onAutoFlattenClose } from '../ingest/position-auto-capture.js';
 import { assertNotShuttingDown, registerOp } from '../lifecycle/shutdown-coordinator.js';
 import { updateMfe } from '../mfe.js';
 import { computeInvalidationHit } from '../pinned-plan.js';
@@ -122,6 +124,10 @@ export class LiveAdapter extends EventEmitter {
     bracketLedger = null;
     bracketManager = null;
     bracketReconciler = null;
+    wave9ProtectionLossHandler;
+    wave9ProtectionLossInFlight = new Set();
+    pendingWave9ProtectionLossBySymbol = new Map();
+    static PENDING_WAVE9_PROTECTION_LOSS_CAP = 100;
     // User-data WebSocket stream — null when mode='off' (REST polling owns reads).
     // In Phase 1 this is dead code on prod (mode='off' is the default); the wiring
     // is in place so Phase 2 onwards only requires a flag flip. Read paths
@@ -167,6 +173,11 @@ export class LiveAdapter extends EventEmitter {
     // getPositions tick, dropped on closePosition or when a symbol vanishes from
     // the open-positions snapshot.
     liveMetadata = new Map();
+    // Position-decision auto-capture wiring (optional). Retained so the internal
+    // bracket_attach_failed auto-flatten can journal its close (issue #196): that
+    // flatten bypasses the close_position tool, so onClosePositionFilled never
+    // runs and the row would orphan as status='open'.
+    autoCapture;
     // Readiness state — mutable, starts INIT_PENDING
     _readiness = 'INIT_PENDING';
     get readiness() {
@@ -190,6 +201,11 @@ export class LiveAdapter extends EventEmitter {
         this.mode = mode;
         this.bracketMode = bracketMode;
         this.userDataStreamMode = userDataStreamMode;
+        // Retained for the auto-flatten journal close capture (issue #196): the
+        // adapter-internal `closePosition(…, 'bracket_attach_failed')` calls bypass
+        // the close_position tool, so onClosePositionFilled never runs for them —
+        // the row orphaned as status='open' until this capture existed.
+        this.autoCapture = autoCapture;
         this.api = new BinancePrivateApi(config);
         if (mode === 'MICRO_LIVE') {
             // sizeCapMultiplier is 1.0 — the agent already sizes for the real wallet.
@@ -216,7 +232,26 @@ export class LiveAdapter extends EventEmitter {
             this.bracketManager = new BracketManager(liveBracketApi, this.bracketLedger);
             this.bracketManager.on('event', (ev) => this.emit('bracket_event', ev));
             this.bracketReconciler = new BracketReconciler(this, this.bracketLedger, this.bracketManager, liveBracketApi);
-            this.bracketReconciler.on('drift', (d) => this.emit('bracket_drift', d));
+            this.bracketReconciler.on('drift', (d) => {
+                this.emit('bracket_drift', d);
+                if (d.kind !== 'position_unprotected'
+                    || !d.symbol
+                    || !d.bracketId
+                    || !d.details?.split(/[+:\s]+/).includes('stop'))
+                    return;
+                const row = this.bracketLedger?.getBySymbol(d.symbol);
+                if (!row || row.bracketId !== d.bracketId)
+                    return;
+                this.notifyWave9ProtectionLoss({
+                    source: 'reconciler_missing',
+                    symbol: normalizeBracketSymbol(d.symbol),
+                    bracketId: d.bracketId,
+                    entryClientOrderId: row.entryCid,
+                    entrySide: row.entrySide,
+                    ...(row.slCid ? { stopClientOrderId: row.slCid } : {}),
+                    detail: d.details,
+                });
+            });
             logger.info(TAG, `Bracket orders ENABLED in mode=${this.bracketMode}`);
         }
         // Forward poller events
@@ -719,6 +754,19 @@ export class LiveAdapter extends EventEmitter {
             }
             // ---- Post-submission bookkeeping ----
             this.intentJournal.updateIntent(clientOrderId, { status: 'confirmed', exchangeOrderId: order.id });
+            // ---- Fill-price enrichment (issue #196) ----
+            // For a marketable LIMIT order Binance's synchronous RESULT response can
+            // come back avgPrice=0 even though it filled (RESULT only guarantees the
+            // fill for MARKET / special-timeInForce LIMIT orders). Every downstream
+            // consumer — bracket direction validation, slippage, journal entry capture
+            // — MUST key off the real fill, never the limit price. Re-query by
+            // clientOrderId (weight 1) to patch order.average BEFORE any of them read
+            // it. Market orders report avgPrice reliably, so this fires only on the
+            // filled-limit edge; best-effort — a failed re-query leaves order.average
+            // as-is (consumers then use a mark price / skip, never the limit).
+            if (order.status === 'closed' && order.filled > 0 && fillPriceFromOrder(order) === null) {
+                await this.enrichFilledAvgPrice(order, clientOrderId, symbol);
+            }
             // Track slippage for market orders that filled immediately
             if (order.status === 'closed' && order.average != null && expectedPrice > 0) {
                 this.slippageTracker.recordFill({
@@ -758,63 +806,84 @@ export class LiveAdapter extends EventEmitter {
             // leg, register the bracket and (for market orders) attach immediately.
             // Limit orders defer attach to the poller's 'filled' event handler.
             if (this.bracketManager && this.bracketLedger && metadata && (metadata.stopPrice !== undefined || metadata.targetPrice !== undefined)) {
-                // Defense-in-depth: the pre-submission check above already rejected sign
-                // errors against the ref price, but re-check against the actual fill
-                // (order.average) in case the fill landed across the level. Crucially, a
-                // failure HERE is post-submission: bare-throwing would abandon a live
-                // position (filled market order) or a resting entry that fills naked
-                // (open limit). So clean up BEFORE throwing.
-                const refPrice = order.average ?? order.price ?? price ?? 0;
-                if (refPrice > 0) {
-                    let dirMsg = null;
+                // Defense-in-depth direction re-check. The pre-submission check above
+                // already rejected sign errors against the ref price; this re-checks once
+                // the order's outcome is known. Reference price by order state:
+                //   - FILLED (status=closed, filled>0): the ACTUAL average fill — NEVER
+                //     the limit price (issue #196). A marketable limit can fill percent-
+                //     scale away from its limit, so comparing the bracket to the limit
+                //     gives a FALSE invalid (needless auto-flatten — LTC 2026-07-14) or
+                //     lets a genuinely wrong stop through. If the fill price is
+                //     unresolvable, SKIP the check — the bracket attach (Binance -2021 on
+                //     a wrong-side stop) is the arbiter; validating against the limit
+                //     would resurrect the bug.
+                //   - still-OPEN resting limit: no fill yet, so the limit price IS the
+                //     correct reference (the order fills at/through its limit).
+                // A failure HERE is post-submission — clean up (flatten the filled
+                // position / cancel the resting order) BEFORE throwing.
+                let dirRef = null;
+                if (order.status === 'closed' && order.filled > 0) {
+                    dirRef = fillPriceFromOrder(order);
+                    if (dirRef === null) {
+                        logger.warn(TAG, `Post-fill bracket direction check skipped for ${symbol}: actual fill price unresolvable (avg=${order.average ?? 'null'} cost=${order.cost} filled=${order.filled}); NOT validating against the limit price — the bracket attach (Binance -2021) is the arbiter`);
+                    }
+                }
+                else if (order.status === 'open') {
+                    const lim = order.price ?? price ?? 0;
+                    dirRef = lim > 0 ? lim : null;
+                }
+                let dirMsg = null;
+                if (dirRef !== null && dirRef > 0) {
                     if (metadata.stopPrice !== undefined) {
-                        dirMsg = validateStopDirection(side, refPrice, metadata.stopPrice);
+                        dirMsg = validateStopDirection(side, dirRef, metadata.stopPrice);
                     }
                     if (!dirMsg && metadata.targetPrice !== undefined) {
-                        dirMsg = validateTargetDirection(side, refPrice, metadata.targetPrice);
+                        dirMsg = validateTargetDirection(side, dirRef, metadata.targetPrice);
                     }
-                    if (dirMsg) {
-                        if (order.status === 'closed' && order.filled > 0) {
-                            logger.error(TAG, `Post-fill bracket direction invalid for ${symbol} (${dirMsg}) — flattening the just-filled position to avoid a naked entry`);
-                            // We have HARD evidence the entry filled (status=closed, filled>0).
-                            // closePosition throws "No open position" when its attempt-1
-                            // fetchPositions returns a *confirmed-empty* snapshot — which, in
-                            // the moments right after a fill, is almost always Binance
-                            // position-state lagging the order response, NOT a real flat.
-                            // Accepting that single failure would fail open and leave the
-                            // position naked (the exact high-risk branch this cleanup exists
-                            // for). Retry across the lag window instead of trusting one snapshot.
-                            let flattened = false;
-                            for (let a = 1; a <= 4 && !flattened; a++) {
-                                try {
-                                    await this.closePosition(symbol, 'bracket_attach_failed');
-                                    flattened = true;
-                                }
-                                catch (err) {
-                                    logger.warn(TAG, `Post-fill flatten attempt ${a}/4 for ${symbol} failed: ${formatError(err)}`);
-                                    if (a < 4)
-                                        await sleep(1500);
-                                }
-                            }
-                            if (!flattened) {
-                                logger.error(TAG, `CRITICAL: post-fill flatten of ${symbol} FAILED after 4 attempts — position is NAKED, immediate operator intervention required`);
-                                this.emit('emergency_progress', { action: 'flatten', status: 'failed', symbol, message: `Naked ${symbol} after invalid bracket — manual close required` });
-                            }
-                        }
-                        else if (order.status === 'open') {
-                            logger.error(TAG, `Post-submit bracket direction invalid for ${symbol} (${dirMsg}) — cancelling the resting entry order so it can't fill unprotected`);
+                }
+                if (dirMsg) {
+                    if (order.status === 'closed' && order.filled > 0) {
+                        logger.error(TAG, `Post-fill bracket direction invalid for ${symbol} (${dirMsg}, fill=${dirRef}) — flattening the just-filled position to avoid a naked entry`);
+                        // We have HARD evidence the entry filled (status=closed, filled>0).
+                        // closePosition throws "No open position" when its attempt-1
+                        // fetchPositions returns a *confirmed-empty* snapshot — which, in
+                        // the moments right after a fill, is almost always Binance
+                        // position-state lagging the order response, NOT a real flat.
+                        // Accepting that single failure would fail open and leave the
+                        // position naked (the exact high-risk branch this cleanup exists
+                        // for). Retry across the lag window instead of trusting one snapshot.
+                        // closePosition journals the auto-flatten close itself (keyed on the
+                        // 'bracket_attach_failed' reason) so the row can't orphan (#196).
+                        let flattened = false;
+                        for (let a = 1; a <= 4 && !flattened; a++) {
                             try {
-                                await this.api.cancelOrderByClientId(clientOrderId, symbol);
+                                await this.closePosition(symbol, 'bracket_attach_failed');
+                                flattened = true;
                             }
                             catch (err) {
-                                logger.error(TAG, `Cancel of resting entry after invalid bracket failed for ${symbol}: ${formatError(err)}`);
+                                logger.warn(TAG, `Post-fill flatten attempt ${a}/4 for ${symbol} failed: ${formatError(err)}`);
+                                if (a < 4)
+                                    await sleep(1500);
                             }
                         }
-                        throw new Error(`Bracket rejected (post-submit): ${dirMsg}`);
+                        if (!flattened) {
+                            logger.error(TAG, `CRITICAL: post-fill flatten of ${symbol} FAILED after 4 attempts — position is NAKED, immediate operator intervention required`);
+                            this.emit('emergency_progress', { action: 'flatten', status: 'failed', symbol, message: `Naked ${symbol} after invalid bracket — manual close required` });
+                        }
+                    }
+                    else if (order.status === 'open') {
+                        logger.error(TAG, `Post-submit bracket direction invalid for ${symbol} (${dirMsg}) — cancelling the resting entry order so it can't fill unprotected`);
+                        try {
+                            await this.api.cancelOrderByClientId(clientOrderId, symbol);
+                        }
+                        catch (err) {
+                            logger.error(TAG, `Cancel of resting entry after invalid bracket failed for ${symbol}: ${formatError(err)}`);
+                        }
                     }
+                    throw new Error(`Bracket rejected (post-submit): ${dirMsg}`);
                 }
                 const bracketId = generateBracketId();
-                this.bracketManager.registerEntry({ symbol, side, stopPrice: metadata.stopPrice, targetPrice: metadata.targetPrice }, bracketId, buildBracketCid(bracketId, 'entry'));
+                this.bracketManager.registerEntry({ symbol, side, stopPrice: metadata.stopPrice, targetPrice: metadata.targetPrice }, bracketId, clientOrderId);
                 if (order.status === 'closed' && order.filled > 0) {
                     // Market order (or limit-that-filled-instantly) — attach now.
                     // We do NOT await: attach can take seconds and we don't want to block
@@ -843,7 +912,8 @@ export class LiveAdapter extends EventEmitter {
             const result = await this.bracketManager.attachBrackets(symbol, entryAmount);
             if (!result.ok) {
                 logger.error(TAG, `Bracket attach FAILED for ${symbol} after ${result.attempts} attempts: ${result.error}. Auto-flattening position.`);
-                // Best-effort emergency close. closePosition has its own retry logic.
+                // Best-effort emergency close. closePosition has its own retry logic +
+                // journals the auto-flatten close itself (keyed on the reason, #196).
                 try {
                     await this.closePosition(symbol, 'bracket_attach_failed');
                 }
@@ -857,6 +927,114 @@ export class LiveAdapter extends EventEmitter {
             logger.error(TAG, `attachBracketsAsync unexpected error for ${symbol}: ${formatError(err)}`);
         }
     }
+    /**
+     * Patch `order.average` with the authoritative average fill price when a
+     * filled order came back without one (marketable-limit RESULT quirk, #196).
+     * Re-queries by clientOrderId (GET /fapi/v1/order, weight 1). Best-effort:
+     * on any failure or an unresolvable re-query the order is left as-is —
+     * downstream then falls back to a mark price / skips capture, NEVER to the
+     * limit price. Mutates `order` in place.
+     */
+    async enrichFilledAvgPrice(order, clientOrderId, symbol) {
+        const rawAvg = order.average;
+        try {
+            const requeried = await this.api.fetchOrderByClientId(clientOrderId, symbol);
+            const resolved = requeried ? fillPriceFromOrder(requeried) : null;
+            if (resolved !== null && resolved > 0) {
+                order.average = resolved;
+                // Carry cumQuote across too, so cost-based consumers (VWAP, slippage)
+                // see the settled notional rather than 0.
+                if ((order.cost === 0 || order.cost == null) && requeried && requeried.cost > 0) {
+                    order.cost = requeried.cost;
+                }
+                logger.info(TAG, `Fill-price enriched for ${symbol}: avg ${rawAvg ?? 'null'} → ${resolved} (re-query by cid; limit price ${order.price ?? 'n/a'})`);
+                return;
+            }
+            logger.warn(TAG, `Fill-price enrichment for ${symbol} could not resolve an average (re-query avg=${requeried?.average ?? 'null'} cost=${requeried?.cost ?? 'null'} filled=${requeried?.filled ?? 'null'}); downstream uses mark price / skips capture, NOT the limit price ${order.price ?? 'n/a'}`);
+        }
+        catch (err) {
+            logger.warn(TAG, `Fill-price enrichment re-query for ${symbol} threw: ${formatError(err)}; leaving average as-is`);
+        }
+    }
+    /**
+     * Journal the close produced by an internal auto-flatten
+     * (`bracket_attach_failed`), so the position row can't orphan as
+     * status='open' (issue #196). These flattens go straight to
+     * `this.closePosition`, bypassing the close_position tool, so
+     * `onClosePositionFilled` never runs for them. Fire-and-forget + fail-open —
+     * never blocks or throws into the flatten path. The entry journal may not be
+     * ready at flatten time (the entry's WS fill can land ~1-2s later), so
+     * `onAutoFlattenClose` polls briefly for the webappPositionId; the boot DB
+     * reconcile sweep is the backstop if the entry never journals.
+     */
+    captureAutoFlattenClose(symbol, closeOrder) {
+        if (!this.autoCapture)
+            return;
+        const fillPrice = fillPriceFromOrder(closeOrder);
+        // A synthetic "already flat" return (filled=0, avg=null) means another path
+        // (a bracket fill / external close) owns the real close — don't mislabel it
+        // as bracket_attach_failed and don't invent a price.
+        if (fillPrice === null || !(closeOrder.filled > 0))
+            return;
+        void onAutoFlattenClose(this.autoCapture, {
+            symbol,
+            fillPrice,
+            fillSize: Math.abs(closeOrder.filled),
+            ...(typeof closeOrder.id === 'string' && closeOrder.id.length > 0
+                ? { exchangeTradeId: closeOrder.id }
+                : {}),
+        }).catch((err) => logger.warn(TAG, `auto-flatten close capture for ${symbol} threw: ${formatError(err)}`));
+    }
+    /** Install the Wave 9-only autonomous recovery bridge. With no handler,
+     *  every generic bracket lifecycle remains byte-for-byte behaviorally
+     *  unchanged. Runtime reapplies this setter after adapter reconnects. */
+    setWave9ProtectionLossHandler(handler) {
+        this.wave9ProtectionLossHandler = handler;
+        if (!handler || this.pendingWave9ProtectionLossBySymbol.size === 0)
+            return;
+        const pending = [...this.pendingWave9ProtectionLossBySymbol.values()];
+        this.pendingWave9ProtectionLossBySymbol.clear();
+        for (const event of pending)
+            this.notifyWave9ProtectionLoss(event);
+    }
+    notifyWave9ProtectionLoss(event) {
+        const handler = this.wave9ProtectionLossHandler;
+        const key = normalizeBracketSymbol(event.symbol);
+        if (!handler || this.wave9ProtectionLossInFlight.has(key)) {
+            // initialize() may start the reconciler/user-data stream before the
+            // durable Wave 9 ledger is loaded by index.ts. Coalesce one latest loss
+            // per symbol and replay it when runtime installs the handler; never let
+            // that startup window silently discard a native-stop failure. The same
+            // queue catches a second loss while recovery is in flight — notably a
+            // freshly re-armed stop cancelled just before the first handler returns.
+            this.pendingWave9ProtectionLossBySymbol.set(key, event);
+            if (this.pendingWave9ProtectionLossBySymbol.size
+                > LiveAdapter.PENDING_WAVE9_PROTECTION_LOSS_CAP) {
+                const oldest = this.pendingWave9ProtectionLossBySymbol.keys().next().value;
+                if (oldest !== undefined) {
+                    this.pendingWave9ProtectionLossBySymbol.delete(oldest);
+                    logger.error(TAG, `Wave 9 protection-loss queue exceeded ${LiveAdapter.PENDING_WAVE9_PROTECTION_LOSS_CAP} ` +
+                        `symbols and evicted ${oldest}; IMMEDIATE MANUAL INTERVENTION REQUIRED`);
+                }
+            }
+            return;
+        }
+        this.wave9ProtectionLossInFlight.add(key);
+        void Promise.resolve()
+            .then(() => handler(event))
+            .catch((error) => {
+            logger.error(TAG, `Wave 9 protection-loss recovery failed for ${event.symbol}: ${formatError(error)}; ` +
+                'IMMEDIATE MANUAL INTERVENTION REQUIRED');
+        })
+            .finally(() => {
+            this.wave9ProtectionLossInFlight.delete(key);
+            const pending = this.pendingWave9ProtectionLossBySymbol.get(key);
+            if (pending) {
+                this.pendingWave9ProtectionLossBySymbol.delete(key);
+                this.notifyWave9ProtectionLoss(pending);
+            }
+        });
+    }
     /**
      * AUTHORITATIVE bracket-lifecycle handler — Binance's ALGO_UPDATE push.
      *
@@ -896,6 +1074,11 @@ export class LiveAdapter extends EventEmitter {
         const symbol = normalizeBracketSymbol(ev.symbol);
         const row = this.bracketLedger?.getBySymbol(symbol);
         const status = ev.status.toUpperCase();
+        const rowIsRecoverable = !!row
+            && (row.state === 'active' || row.state === 'partial' || row.state === 'attaching');
+        const isCurrentStop = parsed.role === 'stop'
+            && row?.bracketId === parsed.bracketId
+            && (!row.slCid || row.slCid === cid);
         // Record the authoritative per-leg WS status for the Tier-1 fast-path of
         // resolveBracketLegLiveness(). Every parsed rc-* lifecycle event, every
         // branch — including CANCELED, which the ledger deliberately does NOT
@@ -989,12 +1172,34 @@ export class LiveAdapter extends EventEmitter {
             else {
                 logger.info(TAG, `ALGO_UPDATE CANCELED on ${symbol} (${cid}) — ledger=${row?.state ?? 'none'} (benign: cancel of an already-terminal/absent bracket).`);
             }
+            if (rowIsRecoverable && isCurrentStop && row) {
+                this.notifyWave9ProtectionLoss({
+                    source: 'algo_canceled',
+                    symbol,
+                    bracketId: row.bracketId,
+                    entryClientOrderId: row.entryCid,
+                    entrySide: row.entrySide,
+                    stopClientOrderId: cid,
+                    detail: `exact native stop reported CANCELED (reason=${ev.reason ?? 'none'})`,
+                });
+            }
             return;
         }
         // NEW / TRIGGERING / REJECTED — informational. REJECTED is worth a WARN
         // (Binance refused the conditional order — e.g. margin check).
         if (status === 'REJECTED') {
             logger.warn(TAG, `ALGO_UPDATE REJECTED on ${symbol} (${cid}) reason=${ev.reason ?? 'none'} — bracket leg refused by Binance; position may be unprotected.`);
+            if (rowIsRecoverable && isCurrentStop && row) {
+                this.notifyWave9ProtectionLoss({
+                    source: 'algo_rejected',
+                    symbol,
+                    bracketId: row.bracketId,
+                    entryClientOrderId: row.entryCid,
+                    entrySide: row.entrySide,
+                    stopClientOrderId: cid,
+                    detail: `exact native stop reported REJECTED (reason=${ev.reason ?? 'none'})`,
+                });
+            }
         }
     }
     /** Expose the bracket manager for agent-facing tools (modify_stop, etc.).
@@ -1062,6 +1267,12 @@ export class LiveAdapter extends EventEmitter {
         // Tier 3 — no answer anywhere.
         return 'unknown';
     }
+    /** Immediate full-shape proof for one exact native conditional order. */
+    async resolveBracketLegProof(cid) {
+        if (!cid)
+            return null;
+        return this.api.queryAlgoOrderProof(cid);
+    }
     /** Symbol-scoped generalization of the trusted-WS fast-path — the
      *  authoritative action-layer guard for the 2026-05-16 INJ bracket spiral.
      *
@@ -1273,6 +1484,14 @@ export class LiveAdapter extends EventEmitter {
                     const order = await this.api.createOrder(symbol, closeSide, 'market', position.contracts, undefined, ccxtParams);
                     logger.info(TAG, `FLATTEN: ${symbol} close order ${order.id} status=${order.status}`);
                     this.emit('emergency_progress', { action: 'flatten', status: 'completed', symbol });
+                    // Auto-flatten (bracket_attach_failed) bypasses the close_position tool,
+                    // so onClosePositionFilled never journals its close and the position row
+                    // orphans as status='open' (issue #196). Journal it here from the real
+                    // close fill. Other reasons (operator_command, agent close_position) are
+                    // journaled by their own paths — don't double-capture.
+                    if (closeReason === 'bracket_attach_failed') {
+                        this.captureAutoFlattenClose(symbol, order);
+                    }
                     return order;
                 }
                 catch (err) {
@@ -1350,12 +1569,17 @@ export class LiveAdapter extends EventEmitter {
             emitUnprotected(`threw: ${formatError(err)}`);
         }
     }
-    async getBalance() {
+    /** Null-honest balance read: null = the fetch FAILED (429 / weight-paced /
+     *  banned) — the caller MUST treat it as UNKNOWN, never as a zero balance.
+     *  Same null≠empty contract as getPositionsOrNull. Decision paths (sizing,
+     *  pre-trade risk) must use this: the legacy getBalance() collapse below
+     *  reads as walletTotal=0 → ~−100% drawdown → RED zone. */
+    async getBalanceOrNull() {
         const balance = await this.api.fetchBalance();
         this.syncRateLimits();
         this.rateLimiter.recordQuery(ENDPOINT_WEIGHTS.fetchBalance ?? 5);
         if (!balance) {
-            return { free: {}, used: {}, total: {} };
+            return null;
         }
         // Binance USDⓈ-M quirk: `availableBalance` is only populated for the primary
         // margin asset (USDT). Secondary collaterals like USDC come back with
@@ -1393,6 +1617,17 @@ export class LiveAdapter extends EventEmitter {
         const cachedPositions = this.reconciler.getLastExchangePositions();
         return this.enricher.enrich(balance, cachedPositions);
     }
+    /** Legacy display-path read. Collapses a FAILED fetch to an empty balance
+     *  object — acceptable for read-only surfaces (fetch_balance tool,
+     *  risk-summary display), a phantom-zero hazard for anything that decides.
+     *  Decision paths use getBalanceOrNull(). */
+    async getBalance() {
+        const balance = await this.getBalanceOrNull();
+        if (!balance) {
+            return { free: {}, used: {}, total: {} };
+        }
+        return balance;
+    }
     /** Re-anchor the realized-today seed + sessionStartNav from /fapi/v1/income.
      *  Throttled to {@link INCOME_REFRESH_MIN_INTERVAL_MS}; UTC date rollover
      *  forces an immediate refresh. Best-effort — failures are logged and
@@ -1534,6 +1769,9 @@ export class LiveAdapter extends EventEmitter {
             out.push({
                 ...p,
                 setupType: p.setupType ?? freshMeta.setupType,
+                missionId: p.missionId ?? freshMeta.missionId,
+                candidateId: p.candidateId ?? freshMeta.candidateId,
+                strategy: p.strategy ?? freshMeta.strategy,
                 thesis: p.thesis ?? freshMeta.thesis,
                 stopPrice: p.stopPrice ?? freshMeta.stopPrice,
                 targetPrice: p.targetPrice ?? freshMeta.targetPrice,
@@ -1618,6 +1856,9 @@ export class LiveAdapter extends EventEmitter {
     async fetchOrder(orderId, symbol) {
         return this.api.fetchOrder(orderId, symbol);
     }
+    async resolveOrderByClientId(clientOrderId, symbol) {
+        return this.api.resolveOrderByClientId(clientOrderId, symbol);
+    }
     async getLastPrice(symbol) {
         const ticker = await this.api.fetchTicker(symbol);
         return ticker?.last ?? null;

package/live/local-signal-service.js

@@ -16,6 +16,9 @@ import { FactSubscriber } from './fact-subscriber.js';
 import { LocalStrategyEvaluator, DEFAULT_EVALUATOR_PARAMS } from './local-strategy-evaluator.js';
 const RECENT_RING = 50;
 const DEFAULT_FACT_STALENESS_MS = 60_000;
+function isDeclarativeConfig(config) {
+    return config.executionModel === undefined || config.executionModel === 'declarative';
+}
 export class LocalSignalService {
     opts;
     subscriber;
@@ -124,12 +127,14 @@ export class LocalSignalService {
             if (!resp.ok)
                 return;
             const body = (await resp.json());
-            const configs = (body.strategies ?? [])
+            if (!Array.isArray(body.strategies))
+                return;
+            const configs = body.strategies
                 .map((r) => r.config)
-                .filter((c) => !!c);
-            // Keep last-known strategies if the fetch returned an empty/garbage set.
-            if (configs.length > 0)
-                this.strategies = configs;
+                .filter((c) => !!c && isDeclarativeConfig(c));
+            // A valid empty list means all generic strategies are off (or only a
+            // dedicated portfolio bundle is active), so clear stale generic rows.
+            this.strategies = configs;
         }
         catch {
             /* keep last-known strategies — fail-open */
@@ -137,7 +142,7 @@ export class LocalSignalService {
     }
     /** Test seam — set strategies without an HTTP fetch. */
     __setStrategiesForTest(s) {
-        this.strategies = s;
+        this.strategies = s.filter((config) => isDeclarativeConfig(config));
     }
     /** Test seam — feed a raw SSE chunk to the subscriber. */
     __ingestForTest(chunk) {

package/live/local-strategy-evaluator.js

@@ -42,6 +42,10 @@ export class LocalStrategyEvaluator {
         const states = [];
         const signals = [];
         for (const config of strategies) {
+            const executionModel = config.executionModel;
+            if (executionModel !== undefined && executionModel !== 'declarative') {
+                continue;
+            }
             const def = adaptStrategy(config);
             // Regime gate (engine.ts): effective floor is the LOWER of the strategy's
             // own minConfidence and the user's regimeConfidenceFloor.

package/live/position-state-store.d.ts

@@ -10,6 +10,10 @@ export interface PositionStateEntry {
     webappPositionId?: string;
     /** exchangeTradeId of the opening fill (audit trail). */
     openedFromExchangeTradeId?: string;
+    /** setup_type from the entry metadata (e.g. 'pullback_trend_short_4h').
+     *  Carried so close paths can record the exit into the re-entry tracker
+     *  keyed by (symbol, setup) — issue #204. Optional; older entries lack it. */
+    setupType?: string;
     /** Last record_position_reviews call timestamp (epoch ms). Drives stale-gate. */
     lastReviewAt?: number;
     lastVerdict?: 'hold' | 'add_on' | 'close_recommended';

package/live/proposal-decision-listener.d.ts

@@ -1,6 +1,8 @@
 import type { BinancePublicApi } from '../ccxt/binance-public.js';
 import type { IExchangeAdapter } from '../exchange-adapter.js';
 import type { AutoCaptureContext } from '../ingest/position-auto-capture.js';
+import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
+import type { Wave9LiveSymbolOwnershipCheck } from '../wave9/live-symbol-ownership.js';
 export interface ProposalDecisionListenerOptions {
     baseUrl: string;
     ingestToken: string;
@@ -8,6 +10,10 @@ export interface ProposalDecisionListenerOptions {
     adapter: IExchangeAdapter;
     binanceApi: BinancePublicApi;
     autoCapture?: AutoCaptureContext;
+    /** Shared mutation serialization and durable Wave 9 ownership check for
+     *  listener-side approved-order execution. */
+    operationLock?: TradingOperationLock;
+    checkWave9LiveSymbolOwnership?: Wave9LiveSymbolOwnershipCheck;
     /** Active poll interval — used while there are pending proposals (or the
      *  previous tick fetched any). Default 3 s. Keeps approval-to-fire latency
      *  low when the operator is actively working through proposals. */

package/live/proposal-decision-listener.js

@@ -56,6 +56,8 @@ export class ProposalDecisionListener {
             adapter: options.adapter,
             binanceApi: options.binanceApi,
             autoCapture: options.autoCapture,
+            operationLock: options.operationLock,
+            checkWave9LiveSymbolOwnership: options.checkWave9LiveSymbolOwnership,
             pollIntervalMs: options.pollIntervalMs ?? 3_000,
             pollIntervalIdleMs: options.pollIntervalIdleMs ?? 15_000,
             driftAbandonR: options.driftAbandonR ?? 0.3,
@@ -221,6 +223,8 @@ export class ProposalDecisionListener {
             binanceApi: this.opts.binanceApi,
             adapter: this.opts.adapter,
             autoCapture: this.opts.autoCapture,
+            operationLock: this.opts.operationLock,
+            checkWave9LiveSymbolOwnership: this.opts.checkWave9LiveSymbolOwnership,
             // proposalManager + userId deliberately omitted — see above.
         });
         if ('error' in result) {