@reefclaw/openclaw-plugin 0.1.6 → 0.1.8

package/bridge/gateway/event-parser.d.ts

@@ -170,8 +170,13 @@ export interface ParsedEvent<E extends ProviderEventName = ProviderEventName> {
 export declare class EventParser {
     /** Buffered assistant text per runId, with timestamps for expiry */
     private assistantBuffers;
-    /** Last decision timestamp (set on lifecycle 'start') */
+    /** Last decision timestamp (set on lifecycle 'end' of a non-errored run) */
     private lastDecisionTs;
+    /** Runs that emitted a lifecycle 'error' — their 'end' must NOT count as a
+     *  decision. Issue #194: bumping on 'start' kept "last decision" fresh
+     *  through an 18h all-models-failed outage, so the dashboard's 2×-interval
+     *  "unresponsive" rung could never fire. Bounded (oldest evicted). */
+    private erroredRuns;
     /** Error timestamps within the rolling window */
     private errorTimestamps;
     /** Symbol for balance currency extraction */

package/bridge/gateway/event-parser.js

@@ -417,8 +417,13 @@ const BUFFER_INACTIVITY_MS = 120_000; // 120 seconds — matches webapp streamin
 export class EventParser {
     /** Buffered assistant text per runId, with timestamps for expiry */
     assistantBuffers = new Map();
-    /** Last decision timestamp (set on lifecycle 'start') */
+    /** Last decision timestamp (set on lifecycle 'end' of a non-errored run) */
     lastDecisionTs = null;
+    /** Runs that emitted a lifecycle 'error' — their 'end' must NOT count as a
+     *  decision. Issue #194: bumping on 'start' kept "last decision" fresh
+     *  through an 18h all-models-failed outage, so the dashboard's 2×-interval
+     *  "unresponsive" rung could never fire. Bounded (oldest evicted). */
+    erroredRuns = new Set();
     /** Error timestamps within the rolling window */
     errorTimestamps = [];
     /** Symbol for balance currency extraction */
@@ -465,10 +470,15 @@ export class EventParser {
         }
         switch (phase) {
             case 'start':
-                this.lastDecisionTs = new Date().toISOString();
                 logger.debug(TAG, `Agent turn started: ${runId}`);
                 return [];
             case 'end': {
+                // A decision = a turn that ENDED without erroring. Bumping on 'start'
+                // (pre-#194) kept the timestamp fresh while every run failed, hiding
+                // an all-models-failed outage from the unresponsive heuristics.
+                if (!this.erroredRuns.delete(runId)) {
+                    this.lastDecisionTs = new Date().toISOString();
+                }
                 logger.debug(TAG, `Agent turn ended: ${runId}`);
                 return this.flushAssistantBuffer(runId);
             }
@@ -476,6 +486,13 @@ export class EventParser {
                 const errMsg = data.error ?? 'Unknown agent error';
                 logger.warn(TAG, `Agent error (run ${runId}): ${errMsg}`);
                 this.errorTimestamps.push(Date.now());
+                this.erroredRuns.add(runId);
+                // Bound the set: an errored run whose 'end' never arrives would leak.
+                if (this.erroredRuns.size > 100) {
+                    const oldest = this.erroredRuns.values().next().value;
+                    if (oldest !== undefined)
+                        this.erroredRuns.delete(oldest);
+                }
                 // Still flush the buffer — partial responses are better than nothing
                 return this.flushAssistantBuffer(runId);
             }

package/bridge/gateway/poller.d.ts

@@ -4,6 +4,7 @@ import type { TickerData, CandleData, OrderData, MarketStructureData, CryptoMetr
 export declare const TICKER_INTERVAL_MS = 5000;
 export declare const OHLCV_INTERVAL_MS = 15000;
 export declare const POSITIONS_INTERVAL_MS = 10000;
+export declare const OPEN_ORDERS_INTERVAL_MS = 60000;
 export declare const MARKET_STRUCTURE_INTERVAL_MS = 60000;
 /** CCXT position — minimal shape needed by poller */
 export interface CcxtPosition {

package/bridge/gateway/poller.js

@@ -25,7 +25,17 @@ export const OHLCV_INTERVAL_MS = 15_000;
 // startup handshake is extra live-system surface area for no extra weight.
 export const POSITIONS_INTERVAL_MS = 10_000;
 const BALANCE_INTERVAL_MS = 10_000;
-const OPEN_ORDERS_INTERVAL_MS = 3_000;
+// 2026-07-21: 3s → 60s, and the poll is now UNSCOPED (no symbol filter). Its
+// only consumer is the fallback cache behind Kill and the reconcile snapshot
+// (no event emission — live order updates ride the WS stream), and both of
+// those are portfolio-wide by contract: a { symbol }-scoped cache silently
+// degraded them to one symbol whenever the fresh all-symbol fetch failed.
+// Unscoped fetchOpenOrders costs Binance weight 80 (regular + algo merged) vs
+// 2 scoped, so the cadence drops to 60s (80/min, vs 40/min before; the old 3s
+// cadence unscoped would be 1600/min ≈ the whole ceiling). Matches the
+// plugin's own 60s algo-refresh; in userDataStream enforce mode the read is
+// served from the WS store at zero REST weight anyway.
+export const OPEN_ORDERS_INTERVAL_MS = 60_000;
 // 2026-05-15: 30s → 60s. get_market_structure fetches SIX timeframes of
 // OHLCV per poll (the heaviest single skill poll). Multi-timeframe trend
 // structure does not meaningfully change in 30s; 60s keeps the Agent-State
@@ -357,7 +367,9 @@ export class Poller {
     }
     async pollOpenOrders() {
         const tool = this.toolMap.fetch_open_orders;
-        const result = await this.http.invoke(tool, { symbol: this.symbol });
+        // Fetch ALL open orders (no symbol filter) — this cache is the fallback
+        // for the portfolio-wide Kill + reconcile snapshot (see interval comment).
+        const result = await this.http.invoke(tool, {});
         const orders = [];
         if (Array.isArray(result.data)) {
             for (const ccxt of result.data) {

package/bridge/providers/gateway.d.ts

@@ -61,6 +61,18 @@ export declare class GatewayProvider implements OpenClawProvider {
     /** Track whether we've received at least one balance poll (needed for equity calculation). */
     private hasReceivedBalance;
     private readonly quoteCurrency;
+    /** issue #213 RED-zone debounce: consecutive RED evaluations + when the
+     *  streak began + when the position snapshot last refreshed. A RED verdict
+     *  must PERSIST and SURVIVE a positions refresh before auto-flatten fires —
+     *  in paper mode the wallet drops by FULL NOTIONAL at open, so a balance
+     *  poll landing before the new position reaches the snapshot reads the
+     *  entry's own notional as a phantom drawdown (observed live: a 38%-of-NAV
+     *  entry reported as a -38.41% RED zone 2s after its fill and was
+     *  auto-flattened). A race artifact cannot outlive one positions poll; a
+     *  real drawdown easily persists. */
+    private redZoneStreak;
+    private redZoneSince;
+    private positionsUpdatedAt;
     private orderTimestamps;
     private cancelTimestamps;
     private agentStateInterval;
@@ -301,8 +313,16 @@ export declare class GatewayProvider implements OpenClawProvider {
      */
     private reportTradeResult;
     /**
-     * Seed lastTradeTs from Intelligence API on startup. One-shot, best-effort.
-     * Prevents "Last Trade: Never" after every restart when the agent is flat.
+     * Seed lastTradeTs from the webapp's exchange-keyed fills ledger on startup.
+     * One-shot, best-effort. Prevents "Last Trade: Never" after every restart
+     * when the agent is flat.
+     *
+     * ★ Issue #194: the previous seed read intel's `trade_results` (closed
+     * round-trips only, single-symbol), which showed "last trade 365h ago"
+     * while the fills ledger had fills from the previous evening. The ledger
+     * (`GET /api/internal/trades`) is the source of truth for fills — seed from
+     * it, filtered to the current trading book. On any failure leave null:
+     * truthful-unknown beats confidently-wrong.
      */
     private seedLastTradeTs;
     /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */

package/bridge/providers/gateway.js

@@ -154,6 +154,18 @@ export class GatewayProvider {
     /** Track whether we've received at least one balance poll (needed for equity calculation). */
     hasReceivedBalance = false;
     quoteCurrency;
+    /** issue #213 RED-zone debounce: consecutive RED evaluations + when the
+     *  streak began + when the position snapshot last refreshed. A RED verdict
+     *  must PERSIST and SURVIVE a positions refresh before auto-flatten fires —
+     *  in paper mode the wallet drops by FULL NOTIONAL at open, so a balance
+     *  poll landing before the new position reaches the snapshot reads the
+     *  entry's own notional as a phantom drawdown (observed live: a 38%-of-NAV
+     *  entry reported as a -38.41% RED zone 2s after its fill and was
+     *  auto-flattened). A race artifact cannot outlive one positions poll; a
+     *  real drawdown easily persists. */
+    redZoneStreak = 0;
+    redZoneSince = 0;
+    positionsUpdatedAt = 0;
     // ---- Rate tracking ----
     orderTimestamps = [];
     cancelTimestamps = [];
@@ -658,6 +670,7 @@ export class GatewayProvider {
         }
         // Update internal state with fresh data (poller may be paused during reconnect)
         this.positions = positions;
+        this.positionsUpdatedAt = Date.now();
         this.balance = balance;
         this.openOrders = openOrders;
         // Compute current NAV for portfolio percent calculation (consistent with computeRiskMetrics)
@@ -1201,6 +1214,7 @@ export class GatewayProvider {
             }
         }
         this.positions = positions;
+        this.positionsUpdatedAt = Date.now();
         this.hasReceivedPositions = true;
         this.trySetSessionStartNav();
         this.emitRiskUpdate();
@@ -1890,10 +1904,32 @@ export class GatewayProvider {
         //     physically impossible under normal market conditions on a bracketed
         //     account. If the math says worse than that, it's bad data — log loudly
         //     and skip instead of closing real positions on a calculation error.
+        //  4. Persistence debounce (issue #213): the balance poll and the position
+        //     snapshot are not atomic. In PAPER mode the simulator deducts FULL
+        //     NOTIONAL from the wallet at open, so in the seconds after a fill the
+        //     wallet already reflects the deduction while `this.positions` does not
+        //     yet contain the new position — equity spuriously drops by exactly the
+        //     entry's notional and any entry >2.5% of NAV reads as a RED drawdown
+        //     (observed live: -38.41% reported 2s after a 38%-of-NAV entry; the
+        //     just-opened position was auto-flattened). A RED verdict therefore
+        //     only licenses the flatten once it (a) persists across REQUIRED_STREAK
+        //     consecutive evaluations, (b) has been standing MIN_RED_PERSISTENCE_MS,
+        //     and (c) has SURVIVED at least one positions refresh since it began —
+        //     the race artifact cannot outlive one positions poll (~10s), while a
+        //     real -2.5% drawdown trivially persists 25s. Cost on a real event:
+        //     the flatten fires ~25-35s later. Cost of a false one: a closed
+        //     position, a rejected-orders window, and a corrupted trading record.
         const uptimeMs = Date.now() - this.startedAt;
         const STARTUP_GRACE_PERIOD_MS = 30_000;
         const IMPOSSIBLE_DRAWDOWN = -0.5;
+        const REQUIRED_RED_STREAK = 3;
+        const MIN_RED_PERSISTENCE_MS = 25_000;
         if (metrics.drawdownZone === 'RED' && this.agentMode === 'ACTIVE') {
+            if (this.redZoneStreak === 0)
+                this.redZoneSince = Date.now();
+            this.redZoneStreak++;
+            const redForMs = Date.now() - this.redZoneSince;
+            const survivedPositionsRefresh = this.positionsUpdatedAt > this.redZoneSince;
             if (uptimeMs < STARTUP_GRACE_PERIOD_MS) {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) but within startup grace period (${Math.round(uptimeMs / 1000)}s) — skipping auto-flatten`);
             }
@@ -1903,6 +1939,11 @@ export class GatewayProvider {
             else if (metrics.utilization.dailyDrawdown < IMPOSSIBLE_DRAWDOWN) {
                 logger.error(TAG, `RED zone drawdown ${(metrics.utilization.dailyDrawdown * 100).toFixed(1)}% exceeds sanity floor ${IMPOSSIBLE_DRAWDOWN * 100}% — refusing auto-flatten, likely equity calculation error (balance.total=${this.balance.total}, sessionStartNav=${this.sessionStartNav}, positions=${this.positions.length})`);
             }
+            else if (this.redZoneStreak < REQUIRED_RED_STREAK ||
+                redForMs < MIN_RED_PERSISTENCE_MS ||
+                !survivedPositionsRefresh) {
+                logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — deferring auto-flatten until the verdict persists (streak ${this.redZoneStreak}/${REQUIRED_RED_STREAK}, ${Math.round(redForMs / 1000)}s/${MIN_RED_PERSISTENCE_MS / 1000}s, survivedPositionsRefresh=${survivedPositionsRefresh}). A fresh entry's notional reads as phantom drawdown until the position snapshot catches up (issue #213); a real drawdown will persist and flatten on a later evaluation.`);
+            }
             else {
                 logger.warn(TAG, `RED zone drawdown detected (${metrics.drawdownZoneMessage}) — auto-flattening all positions`);
                 // Route through executeEmergency (NOT executeFlatten directly) so the
@@ -1917,6 +1958,11 @@ export class GatewayProvider {
                 });
             }
         }
+        else {
+            // Any non-RED evaluation clears the streak — the race artifact resolves
+            // the moment the positions snapshot includes the new position.
+            this.redZoneStreak = 0;
+        }
         // Include position snapshots + balance in risk_update so the webapp can
         // update KPI/PnL without depending on market_data ticker events.
         const equity = this.computeEquity();
@@ -2097,27 +2143,39 @@ export class GatewayProvider {
         this.inFlightReports.push(report);
     }
     /**
-     * Seed lastTradeTs from Intelligence API on startup. One-shot, best-effort.
-     * Prevents "Last Trade: Never" after every restart when the agent is flat.
+     * Seed lastTradeTs from the webapp's exchange-keyed fills ledger on startup.
+     * One-shot, best-effort. Prevents "Last Trade: Never" after every restart
+     * when the agent is flat.
+     *
+     * ★ Issue #194: the previous seed read intel's `trade_results` (closed
+     * round-trips only, single-symbol), which showed "last trade 365h ago"
+     * while the fills ledger had fills from the previous evening. The ledger
+     * (`GET /api/internal/trades`) is the source of truth for fills — seed from
+     * it, filtered to the current trading book. On any failure leave null:
+     * truthful-unknown beats confidently-wrong.
      */
     async seedLastTradeTs() {
         if (this.lastTradeTs)
             return; // Already set (e.g. from WS event during init)
-        const url = this.config.intelligenceUrl;
         const token = this.config.connectionToken;
-        if (!url || !token)
+        if (!token)
             return;
+        // www is load-bearing: reefclaw.com 307-redirects and Node fetch strips
+        // the Authorization header on cross-origin redirect (same as bridge.ts).
+        const base = (process.env.REEFCLAW_API_URL || 'https://www.reefclaw.com').replace(/\/$/, '');
+        const mode = this.tradingMode === 'PAPER' ? 'paper' : 'live';
         try {
-            const res = await fetch(`${url}/api/analytics/${this.config.symbol.replace('/', '')}/trades?limit=1`, {
+            const res = await fetch(`${base}/api/internal/trades?limit=1&mode=${mode}`, {
                 headers: { Authorization: `Bearer ${token}` },
                 signal: AbortSignal.timeout(5_000),
             });
             if (!res.ok)
                 return;
-            const trades = await res.json();
-            if (trades.length > 0 && trades[0].timestamp) {
-                this.lastTradeTs = trades[0].timestamp;
-                logger.info(TAG, `Seeded lastTradeTs from Intelligence: ${this.lastTradeTs}`);
+            const body = (await res.json());
+            const ts = body.trades?.[0]?.fillTimestamp;
+            if (ts) {
+                this.lastTradeTs = ts;
+                logger.info(TAG, `Seeded lastTradeTs from trades ledger (${mode}): ${this.lastTradeTs}`);
                 this.emitAgentState(); // Re-emit with updated timestamp
             }
         }

package/ccxt/public-market-data-api.d.ts

@@ -9,4 +9,18 @@ export interface PublicMarketDataApi {
     fetchOrderBook(symbol: string, limit?: number): Promise<OrderBookDepth | null>;
     fetchOHLCV(symbol: string, timeframe?: string, limit?: number): Promise<CcxtOHLCV[] | null>;
 }
+/** Which exchange serves the public market-data tools (fetch_ticker,
+ *  fetch_ohlcv, get_orderbook, get_market_structure, …).
+ *
+ *  The configured VENUE decides, in BOTH books — a hyperliquid venue must
+ *  never read Binance prices (live included: the agent would be running
+ *  technical analysis on the wrong exchange's data while trading real money
+ *  on HL). The intel price relay is a Binance-venue, paper-only escape hatch
+ *  for 451-geo-blocked hosts. */
+export declare function resolveMarketDataSource(opts: {
+    venue: 'binance' | 'hyperliquid';
+    isLive: boolean;
+    paperDataSource: 'binance' | 'intel';
+    hasConnectionToken: boolean;
+}): 'hyperliquid' | 'intel' | 'binance';
 export {};

package/ccxt/public-market-data-api.js

@@ -6,4 +6,18 @@
 // Deliberately EXCLUDES probeReachability: that is Binance-specific and only
 // the readiness reporter uses it — it must always probe the REAL Binance host
 // to detect the 451, so it keeps a concrete BinancePublicApi, never this.
-export {};
+/** Which exchange serves the public market-data tools (fetch_ticker,
+ *  fetch_ohlcv, get_orderbook, get_market_structure, …).
+ *
+ *  The configured VENUE decides, in BOTH books — a hyperliquid venue must
+ *  never read Binance prices (live included: the agent would be running
+ *  technical analysis on the wrong exchange's data while trading real money
+ *  on HL). The intel price relay is a Binance-venue, paper-only escape hatch
+ *  for 451-geo-blocked hosts. */
+export function resolveMarketDataSource(opts) {
+    if (opts.venue === 'hyperliquid')
+        return 'hyperliquid';
+    if (!opts.isLive && opts.paperDataSource === 'intel' && opts.hasConnectionToken)
+        return 'intel';
+    return 'binance';
+}

package/config/plugin-config-io.d.ts

@@ -195,6 +195,13 @@ export interface PluginConfigFile {
     [extra: string]: unknown;
 }
 export declare function defaultConfigPath(): string;
+/** Best-effort read of the operator's stop-watcher cadence override
+ *  (`stopWatcher.intervalMs`). Undefined (default applies) unless the config
+ *  holds a finite positive number. Read at every watcher CONSTRUCTION — boot
+ *  AND runtime reconnects — so a mode/credential swap can't silently revert
+ *  the override to the default (same read-at-build-time pattern as
+ *  loadBracketMode). */
+export declare function loadStopWatcherIntervalMs(path?: string): number | undefined;
 /** Read the config file. Returns `{}` if the file doesn't exist.
  *  Throws if the file exists but is unreadable or not valid JSON — callers
  *  should treat that as an abort signal, not silently overwrite. */

package/config/plugin-config-io.js

@@ -38,6 +38,21 @@ export function readOpenClawConnection() {
 export function defaultConfigPath() {
     return join(homedir(), '.reefclaw', 'plugin-config.json');
 }
+/** Best-effort read of the operator's stop-watcher cadence override
+ *  (`stopWatcher.intervalMs`). Undefined (default applies) unless the config
+ *  holds a finite positive number. Read at every watcher CONSTRUCTION — boot
+ *  AND runtime reconnects — so a mode/credential swap can't silently revert
+ *  the override to the default (same read-at-build-time pattern as
+ *  loadBracketMode). */
+export function loadStopWatcherIntervalMs(path) {
+    try {
+        const swMs = readPluginConfig(path).stopWatcher?.intervalMs;
+        if (typeof swMs === 'number' && Number.isFinite(swMs) && swMs > 0)
+            return swMs;
+    }
+    catch { /* best-effort — default applies */ }
+    return undefined;
+}
 /** Read the config file. Returns `{}` if the file doesn't exist.
  *  Throws if the file exists but is unreadable or not valid JSON — callers
  *  should treat that as an abort signal, not silently overwrite. */

package/index.js

@@ -12,6 +12,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { BinancePublicApi } from './ccxt/binance-public.js';
 import { IntelPublicApi } from './ccxt/intel-public.js';
+import { resolveMarketDataSource } from './ccxt/public-market-data-api.js';
 import { BinancePrivateApi } from './ccxt/binance-private.js';
 import { ExchangeSimulator } from './simulator/exchange-simulator.js';
 import { ShadowTracker } from './shadow/shadow-tracker.js';
@@ -31,7 +32,9 @@ import { PositionDecisionsClient } from './ingest/position-decisions-client.js';
 import { PositionStateStore } from './live/position-state-store.js';
 import { PendingEntryStore } from './ingest/pending-entry-metadata.js';
 import { onReconcilerObservedClose, reconcileStateStoreOnStartup } from './ingest/reconciler-cleanup.js';
-import { reconcileDbOpenVsExchange } from './ingest/reconcile-db-vs-exchange.js';
+import { reconcileDbOpenVsExchange, startPeriodicDbReconcile } from './ingest/reconcile-db-vs-exchange.js';
+import { onStopWatcherClose } from './ingest/position-auto-capture.js';
+import { ReentryTracker } from './portfolio/reentry-tracker.js';
 import { startReadinessReporter } from './ingest/readiness-reporter.js';
 import { IntelMicrostructureAssembler } from './live/microstructure-assembler.js';
 import { recordPositionReviewsTool } from './tools/record-position-reviews.js';
@@ -44,7 +47,7 @@ import { queryReviewOutcomesTool } from './tools/query-review-outcomes.js';
 import { loadPositionReviewMode } from './config/position-review-config.js';
 import { installSignalHandlers } from './lifecycle/install-signal-handlers.js';
 import { SerialTradingOperationLock } from './lifecycle/trading-operation-lock.js';
-import { readPluginConfig, readOpenClawConnection } from './config/plugin-config-io.js';
+import { readPluginConfig, readOpenClawConnection, loadStopWatcherIntervalMs } from './config/plugin-config-io.js';
 import { startConnectorSupervisor, hasBundledBridge } from './connector-supervisor.js';
 import { ToolGate } from './config/tool-gate.js';
 import { gateStore } from './config/gate-store.js';
@@ -1135,6 +1138,9 @@ const paperTradingPlugin = {
         // position doesn't leak as status='open' forever (close-bypass class). On by
         // default; env kill-switch RC_JOURNAL_CLOSE_ON_FILL=off disables it.
         const closeOnReduceOnlyFill = process.env.RC_JOURNAL_CLOSE_ON_FILL !== 'off';
+        // Re-entry tracker (issue #204): every close path records the exit so
+        // scan_pairs can flag setups already traded within the current signal bar.
+        const reentryTracker = new ReentryTracker();
         const autoCapture = {
             decisionsClient: positionDecisionsClient,
             stateStore: positionStateStore,
@@ -1146,6 +1152,10 @@ const paperTradingPlugin = {
             // closure — only invoked on a fill, long after `runtime` is built), so it
             // follows a live<->paper reconnect.
             resolveMode: () => (runtime.adapter.isLive ? 'live' : 'paper'),
+            // Active adapter at capture time (deferred closure, same as resolveMode).
+            // Drives the stale-state defense in onCreateOrderFilled (issue #199).
+            resolveAdapter: () => runtime.adapter,
+            reentryTracker,
             // Venue tag (positions.exchange, migration 0058) — static per process;
             // a venue change requires config edit + restart.
             venue,
@@ -1171,9 +1181,16 @@ const paperTradingPlugin = {
         // ingest credentials. See docs/APPROVAL_MODE_DESIGN.md §2 + §7.3.
         let proposalDecisionListener;
         if (tradingMode === 'MICRO_LIVE' || tradingMode === 'LIVE') {
-            if (!exchangeConfig) {
+            // Per-VENUE credential presence (rehearsal find #4): this safety check
+            // predated the venue seam and tested only the Binance shape, so a
+            // PERSISTED HL MICRO_LIVE (tradingMode written by the runtime flip)
+            // silently fell back to PAPER on every reboot — while the same config
+            // flipped live fine at runtime. The per-venue gate above is the real
+            // validation; this remains the defense-in-depth backstop.
+            const liveCredsPresent = venue === 'hyperliquid' ? hlCredentials !== null : exchangeConfig !== null;
+            if (!liveCredsPresent) {
                 // Already handled above (falls back to PAPER), but safety check
-                logger.error(TAG, `${tradingMode} mode requires exchange config — this should not happen`);
+                logger.error(TAG, `${tradingMode} mode requires ${venue} exchange credentials — this should not happen`);
                 adapter = new PaperAdapter(simulator);
                 tradingMode = 'PAPER';
             }
@@ -1391,7 +1408,17 @@ const paperTradingPlugin = {
                             // are status='open' but absent from the exchange (closed on-exchange
                             // while down / state-store wiped). Same trusted-snapshot-only rule —
                             // a null fetch must never be read as "flat" and close the book.
-                            await reconcileDbOpenVsExchange({ decisionsClient: positionDecisionsClient, userId: positionDecisionsUserId }, trusted.map((p) => p.symbol));
+                            await reconcileDbOpenVsExchange({
+                                decisionsClient: positionDecisionsClient,
+                                userId: positionDecisionsUserId,
+                                // This boot pass only runs in the live-adapter init path and
+                                // diffs against the LIVE snapshot — scope the DB read to the
+                                // live book so open paper rows aren't misread as orphans.
+                                resolveMode: () => 'live',
+                                // …and to the ACTIVE venue (issue #209 item 5): the other
+                                // venue's open rows can never appear in this snapshot.
+                                resolveExchange: () => venue,
+                            }, trusted.map((p) => p.symbol));
                         }
                         else {
                             logger.warn(TAG, 'Startup reconciliation skipped — positions fetch untrusted (null); state-store left untouched. Runtime drift_detected + periodic reconcilers cover the gap.');
@@ -1408,27 +1435,30 @@ const paperTradingPlugin = {
         else {
             adapter = new PaperAdapter(simulator);
         }
-        // PAPER market-data source selection.
+        // Public market-data source selection.
         //
         // Venue precedence (Hyperliquid Phase 1 — docs/HYPERLIQUID_INTEGRATION_PLAN.md):
-        // the configured VENUE decides which exchange prices paper mode, full stop.
-        // venue='hyperliquid' → every public read (PaperMarketFeed marks, the
-        // simulator's fill prices, fetch_ticker/fetch_ohlcv/get_orderbook tools)
-        // comes from Hyperliquid's keyless /info endpoints; the Binance-only
+        // the configured VENUE decides which exchange serves public reads, full
+        // stop, in BOTH books. venue='hyperliquid' → every public read
+        // (PaperMarketFeed marks, the simulator's fill prices,
+        // fetch_ticker/fetch_ohlcv/get_orderbook tools — paper AND live) comes
+        // from Hyperliquid's keyless /info endpoints; the Binance-only
         // `paperMarketDataSource:'intel'` escape hatch does not apply (intel has
         // no HL rows until Phase 2 — silently serving Binance prices for a
         // Hyperliquid book would be a lie, the exact class the symbol-translation
-        // rule forbids).
+        // rule forbids). Pre-fix this was gated on !adapter.isLive, so a LIVE
+        // boot on venue=hyperliquid fell through to Binance for all six
+        // market-data tools while executing on HL.
         //
         // Binance venue (default) is unchanged: a host Binance geo-blocks (HTTP
-        // 451) can route PRICE reads through the intel service by setting
+        // 451) can route PAPER price reads through the intel service by setting
         // plugin-config `paperMarketDataSource:'intel'` (GET /api/price/:symbol).
-        // LIVE always uses the real exchange, and the readiness reporter probes
-        // the CONFIGURED venue. Kill-switch RC_PAPER_MARKET_DATA=binance forces
-        // the Binance-direct default (binance venue only).
+        // The readiness reporter probes the CONFIGURED venue. Kill-switch
+        // RC_PAPER_MARKET_DATA=binance forces the Binance-direct default
+        // (binance venue only).
         //
         // hlPublicApi is constructed once per process when the venue is
-        // hyperliquid — shared by the paper data path and the readiness probe.
+        // hyperliquid — shared by the market-data path and the readiness probe.
         const hlPublicApi = venue === 'hyperliquid' ? new HyperliquidPublicApi({ testnet: venueTestnet }) : null;
         let configuredPaperSource;
         try {
@@ -1440,20 +1470,24 @@ const paperTradingPlugin = {
         const paperDataSource = process.env.RC_PAPER_MARKET_DATA === 'binance'
             ? 'binance'
             : configuredPaperSource ?? 'binance';
-        const useIntelPaperData = venue === 'binance' &&
-            !adapter.isLive && paperDataSource === 'intel' && connectionToken.length > 0;
-        const marketDataApi = !adapter.isLive && hlPublicApi
+        const marketDataSource = resolveMarketDataSource({
+            venue,
+            isLive: adapter.isLive,
+            paperDataSource,
+            hasConnectionToken: connectionToken.length > 0,
+        });
+        const marketDataApi = marketDataSource === 'hyperliquid' && hlPublicApi
             ? hlPublicApi
-            : useIntelPaperData
+            : marketDataSource === 'intel'
                 ? new IntelPublicApi({ connectionToken, intelligenceUrl })
                 : binanceApi;
-        if (!adapter.isLive && hlPublicApi) {
-            logger.info(TAG, `PAPER market data sourced from Hyperliquid${venueTestnet ? ' TESTNET' : ''} (venue=hyperliquid) — use USDC pairs (e.g. BTC/USDC)`);
+        if (marketDataSource === 'hyperliquid') {
+            logger.info(TAG, `${adapter.isLive ? 'LIVE' : 'PAPER'} market data sourced from Hyperliquid${venueTestnet ? ' TESTNET' : ''} (venue=hyperliquid) — use USDC pairs (e.g. BTC/USDC)`);
             if (paperDataSource === 'intel') {
                 logger.warn(TAG, 'paperMarketDataSource=intel is a Binance-venue option — ignored on venue=hyperliquid (intel has no Hyperliquid rows until Phase 2)');
             }
         }
-        else if (useIntelPaperData) {
+        else if (marketDataSource === 'intel') {
             logger.warn(TAG, 'PAPER market data routed through intel (paperMarketDataSource=intel) — prices from GET /api/price; live + readiness still use Binance directly');
         }
         else if (venue === 'binance' && !adapter.isLive && paperDataSource === 'intel' && connectionToken.length === 0) {
@@ -1479,15 +1513,10 @@ const paperTradingPlugin = {
         // see stop-watcher.ts. Operators can override / revert with zero deploy
         // via plugin-config.json `stopWatcher.intervalMs`. Best-effort read;
         // any failure falls back to the (already-reduced) default.
-        let stopWatcherIntervalMs;
-        try {
-            const swMs = readPluginConfig().stopWatcher?.intervalMs;
-            if (typeof swMs === 'number' && Number.isFinite(swMs) && swMs > 0) {
-                stopWatcherIntervalMs = swMs;
-                logger.info(TAG, `Stop-watcher interval overridden via plugin-config: ${swMs}ms`);
-            }
+        const stopWatcherIntervalMs = loadStopWatcherIntervalMs();
+        if (stopWatcherIntervalMs !== undefined) {
+            logger.info(TAG, `Stop-watcher interval overridden via plugin-config: ${stopWatcherIntervalMs}ms`);
         }
-        catch { /* best-effort — default applies */ }
         const wave9OperationLock = new SerialTradingOperationLock();
         const bootstrapWatcher = stopWatcherIntervalMs !== undefined
             ? new PositionWatcher(adapter, stopWatcherIntervalMs, wave9OperationLock)
@@ -1502,6 +1531,23 @@ const paperTradingPlugin = {
         if (!adapter.isLive) {
             marketFeed.start();
         }
+        // Journal capture for stop-watcher auto-closes (issue #199). Wired onto
+        // EVERY watcher — the bootstrap one here, reconnect-created ones via the
+        // runtime's onWatcherCreated hook — so a watcher close always journals its
+        // close and drops the state-store mapping (no more phantom positions).
+        const wireWatcherJournalCapture = (watcher) => {
+            watcher.on('stop_closed', (ev) => {
+                onStopWatcherClose(autoCapture, {
+                    symbol: ev.symbol,
+                    stopPrice: ev.stopPrice,
+                    markPrice: ev.markPrice,
+                    order: ev.order,
+                }).catch((err) => {
+                    logger.warn(TAG, `stop-watcher close capture failed: ${formatError(err)}`);
+                });
+            });
+        };
+        wireWatcherJournalCapture(bootstrapWatcher);
         const runtime = new PluginRuntime({
             adapter,
             mode: tradingMode,
@@ -1509,7 +1555,45 @@ const paperTradingPlugin = {
             stopWatcher: bootstrapWatcher,
             marketFeed,
             operationLock: wave9OperationLock,
+            onWatcherCreated: wireWatcherJournalCapture,
         });
+        // Periodic DB-vs-exchange sweep (issues #199/#203): the boot-only reconcile
+        // left phantom-open journal rows alive for days between restarts. Runs for
+        // BOTH books (the paper book previously had NO reconcile at all); trusted-
+        // snapshot discipline preserved (null → skip). First pass shortly after
+        // boot so restart-deploys heal existing phantoms immediately.
+        const dbReconcileSweep = startPeriodicDbReconcile({
+            decisionsClient: positionDecisionsClient,
+            userId: positionDecisionsUserId,
+            resolveAdapter: () => runtime.adapter,
+            // Scope each tick's DB read to the ACTIVE book (deferred closure —
+            // follows a set_trading_mode reconnect). Without this, the sweep
+            // misreads the inactive book's open rows as orphans and synthetically
+            // closes them (they can never appear in this adapter's snapshot).
+            resolveMode: () => (runtime.adapter.isLive ? 'live' : 'paper'),
+            // Venue axis (issue #209 item 5): scope to the configured venue so a
+            // two-venue tenant's other-venue rows are never misread as orphans.
+            resolveExchange: () => venue,
+            describeLastExit: (symbol) => {
+                const a = runtime.adapter;
+                if (a instanceof PaperAdapter) {
+                    const canon = symbol.split(':')[0];
+                    const th = a.getSimulator().getState().tradeHistory;
+                    for (let i = th.length - 1; i >= 0; i--) {
+                        if (th[i].symbol.split(':')[0] === canon) {
+                            const t = th[i];
+                            return `paper engine last trade: close ${t.side} ${t.quantity} @ ${t.exitPrice} at ${t.closedAt} (pnl ${t.realizedPnl.toFixed(4)})`;
+                        }
+                    }
+                    return 'paper engine has NO trade record for this symbol';
+                }
+                return undefined;
+            },
+        });
+        if (dbReconcileSweep) {
+            const bootSweep = setTimeout(() => { void dbReconcileSweep.runOnce(); }, 15_000);
+            bootSweep.unref?.();
+        }
         const intelDeps = { connectionToken, apiBaseUrl };
         // venue rides the deps so every intel tool maps agent-facing symbols to
         // the venue's intel namespace (plan §5.3) — absent/'binance' is
@@ -2426,6 +2510,7 @@ const paperTradingPlugin = {
                 execute: async (_id, params) => jsonResult(await scanPairsTool(params ?? {}, intelApiDeps, {
                     decisionsClient: positionDecisionsClient,
                     userId: positionDecisionsUserId,
+                    reentryTracker,
                 })),
             },
             {