@senpi/runtime 3.0.9-dev.feat-strategy-compos.20260721003344 → 3.0.9-dev.feat-strategy-compos.20260722213012

package/dist/composer/verbs/_live.py

@@ -96,10 +96,15 @@ class LiveState:
 # --------------------------------------------------------------------------- default seam impl
 
 def default_system_state(runtime_id: Optional[str]) -> LiveState:
-    """Production :data:`SystemStateFn`: shell ``openclaw senpi state --json [-r <id>]`` (RPC
-    ``senpi.getSystemState``) and parse the one matching runtime's components. NEVER throws — every
-    failure path degrades to ``LiveState(available=False, reason=...)`` so status stays read-only
-    and prints an honest unavailable section."""
+    """Production :data:`SystemStateFn`. FIRST branch (J9): when the rim handed down a live document
+    (``SENPI_LIVE_FILE``), serve the system state from its pre-fetched ``system_state`` section — NO
+    openclaw boot. The ``senpi state --json`` shell-out below remains ONLY as the FALLBACK for a
+    direct/offline invocation with no live-file. NEVER throws — every failure path degrades to
+    ``LiveState(available=False, reason=...)`` so status stays read-only and prints an honest
+    unavailable section (CMP259)."""
+    doc = _box.load_live_document()
+    if doc is not None and isinstance(doc.get("system_state"), dict):
+        return _live_system_state(doc["system_state"], runtime_id)
     args = ["openclaw", "senpi", "state", "--json"]
     if runtime_id:
         args += ["-r", runtime_id]
@@ -112,6 +117,25 @@ def default_system_state(runtime_id: Optional[str]) -> LiveState:
     return parse_system_state(res.stdout, runtime_id)
 
 
+def _live_system_state(section: dict, runtime_id: Optional[str]) -> LiveState:
+    """Serve a :class:`LiveState` from the rim-served document's ``system_state`` section (J9). The
+    rim fetches ``senpi.getSystemState`` UNSCOPED (all runtimes) into one document; this scopes it to
+    ``runtime_id`` EXACTLY as the gateway's ``-r`` would have — filtering the states to the matching
+    runtime and reusing :func:`parse_system_state` UNCHANGED. A ``-r`` miss yields an empty envelope,
+    so parse_system_state returns the identical "runtime is not running" degrade the scoped shell
+    would. An ``ok:false`` section (the rim could not reach the gateway) stays exactly as LOUD as the
+    shell path's failure (CMP259) — never a silent partial."""
+    if not section.get("ok"):
+        reason = section.get("reason") or "gateway unreachable or errored"
+        return LiveState(False, reason=reason, runtime_id=runtime_id)
+    states = section.get("states")
+    states = states if isinstance(states, list) else []
+    if runtime_id:
+        states = [s for s in states if isinstance(s, dict)
+                  and (s.get("runtimeId") == runtime_id or s.get("runtimeName") == runtime_id)]
+    return parse_system_state(json.dumps({"ok": True, "states": states}), runtime_id)
+
+
 def parse_system_state(stdout: str, runtime_id: Optional[str]) -> LiveState:
     """Parse the ``senpi state --json`` envelope (``{ok, states:[RuntimeSystemState...]}``) into a
     :class:`LiveState`. Tolerant: a non-JSON body, an ok:false error, or zero matching states all
@@ -244,6 +268,23 @@ def human_tier(tier_index, tier_count) -> str:
     return f"tier {tier_index + 1} of {n}"
 
 
+def is_tier_armed(p: dict) -> bool:
+    """Whether a live position has an ARMED profit-ratchet tier — derived DIRECTLY from the engine's
+    ``currentTierIndex`` (0-based, in range against ``tiers``), never from a single fail-open
+    ``phase`` field or a separate ratchet-list lookup.
+
+    This is the field-log incident's fix. A sibling engine (senpi-portfolio's portfolio.py) decided
+    "armed" from the presence of a matched ``ratchet_stop_list`` row keyed by asset, whose container
+    it parsed under ``configs/ratchetStops/data/items`` — but the live API returns the rows under
+    ``positions``, so the lookup silently missed and EVERY armed position (a real ``currentTierIndex``
+    of 1 with an active SL order id) was downgraded to "not yet armed / hard_stop null". The box
+    engine's ``getSystemState`` already carries ``currentTierIndex`` on each position, so we read the
+    armed state off it and never reconstruct it from a second, mis-parsed source."""
+    ti = p.get("currentTierIndex")
+    tiers = p.get("tiers") or []
+    return isinstance(ti, int) and 0 <= ti < len(tiers)
+
+
 # --------------------------------------------------------------------------- scanner rendering
 
 def _scanner_role(scanner_id: str) -> str:
@@ -427,9 +468,12 @@ def render_protection_lines(p: dict) -> list[str]:
         f"high-water {_price(hw)} = peak {_pct(hw_roe, signed=True)})"
     ]
 
-    # Phase + active tier, in 1-based human terms.
+    # Phase + active tier, in 1-based human terms. ARMED is derived from currentTierIndex DIRECTLY
+    # (is_tier_armed) — an armed tier IS phase 2 by engine definition, so we never let a stale/absent
+    # ``phase`` field downgrade a genuinely-armed position to the phase-1 "no tier armed" rendering
+    # (the field-log incident: currentTierIndex=1 + an active SL order rendered "not yet armed").
     tier_human = human_tier(tier_idx, len(tiers))
-    if phase == 2 and isinstance(tier_idx, int) and tier_idx >= 0 and tier_idx < len(tiers):
+    if is_tier_armed(p):
         tier = tiers[tier_idx] if isinstance(tiers[tier_idx], dict) else {}
         lock_hw = tier.get("lockHwPct")
         locked = p.get("lockedProfitPct")

package/dist/composer/verbs/close.py

@@ -56,7 +56,14 @@ from ._box import (
     McpFn,
     wallet_match,
 )
-from ._layout import COMPOSER_DIR, LEGACY_STRATEGIES_DIR, iter_release_dirs
+from ._layout import (
+    COMPOSER_DIR,
+    KIND_MANUAL,
+    LEGACY_STRATEGIES_DIR,
+    iter_release_dirs,
+    read_strategy_kind,
+    resolve_wallet_json,
+)
 from .install import INSTALL_JSON
 
 CLOSING = "CLOSING"
@@ -366,6 +373,32 @@ def _resolve_targets(target: str, base_state_dir: str, strategies: list,
             ))
         return out
 
+    # (manual) J3: a MANUAL strategy owns a canonical wallet.json marked ``kind: manual`` but NO
+    # install.json artifact (it has no runtime and was never installed). Resolve it FROM that record
+    # — wallet + backend strategyId — so close discovers it directly (not reliant on MCP name-match)
+    # and reports source="manual". The teardown is naturally REDUCED: _close_one finds no runtime to
+    # stop (there is none) and submits strategy_close, which flattens any positions + returns funds —
+    # exactly the right and sanctioned teardown for a manual strategy (no runtime-delete step).
+    if read_strategy_kind(base_state_dir, target) == KIND_MANUAL:
+        wj_path, _layout = resolve_wallet_json(base_state_dir, target)
+        rec: dict = {}
+        if wj_path is not None:
+            try:
+                rec = json.loads(wj_path.read_text(encoding="utf-8"))
+            except (OSError, json.JSONDecodeError):
+                rec = {}
+        wallet = str(rec.get("wallet") or "")
+        rec_sid = rec.get("strategyId")
+        s = next((s for s in strategies
+                  if (rec_sid and _strat_id(s) == rec_sid) or wallet_match(_strat_wallet(s), wallet)),
+                 None)
+        return [CloseTarget(
+            wallet=wallet, source="manual",
+            strategy_id=rec_sid or (_strat_id(s) if s else None),
+            status=str(_strat_status(s) or "").upper() if s else None,
+            label=f"{target}:manual",
+        )]
+
     # (legacy) match the strategy record by strategyId, by OLD-shape skillName attribution, OR by
     # NEW-shape (H4) strategyName. The three legs together discover BOTH strategies already live in
     # the field (skillName == the strategy name) and composer-minted ones (skillName ==
@@ -407,8 +440,12 @@ def _live_runtime_for(runtimes: list, wallet: str, runtime_id: Optional[str]):
 
 
 def _close_one(t: CloseTarget, list_fn: ListFn, delete_fn: DeleteFn,
-               mcp_fn: McpFn, mcp_ok: bool) -> InstanceResult:
-    """Enforce the invariant for ONE strategy: STOP runtime → CONFIRM gone → TRIGGER close."""
+               mcp_fn: McpFn, mcp_ok: bool, confirm_list_fn: ListFn) -> InstanceResult:
+    """Enforce the invariant for ONE strategy: STOP runtime → CONFIRM gone → TRIGGER close.
+
+    ``list_fn`` supplies the DISCOVERY read (may come from a rim-served snapshot, J9); ``confirm_list_fn``
+    is the post-delete CONFIRM re-read, which MUST be a FRESH read — never a pre-run snapshot that
+    would falsely see the just-deleted runtime as still live (CMP221)."""
     rec = InstanceResult(label=t.label or (t.wallet[:14] + "…"), wallet=t.wallet,
                          verdict=CLOSING, source=t.source, strategy_id=t.strategy_id,
                          runtime_id=t.runtime_id, strategy_status=t.status)
@@ -432,8 +469,9 @@ def _close_one(t: CloseTarget, list_fn: ListFn, delete_fn: DeleteFn,
                 Location(),
             )
             return rec
-        # CONFIRM gone — re-list; the invariant forbids strategy_close while the delete is unconfirmed.
-        if _live_runtime_for(list_fn(), t.wallet, t.runtime_id) is not None:
+        # CONFIRM gone — re-list FRESH; the invariant forbids strategy_close while the delete is
+        # unconfirmed (a rim-served snapshot predates the delete, so the confirm never reads it — J9).
+        if _live_runtime_for(confirm_list_fn(), t.wallet, t.runtime_id) is not None:
             rec.verdict = FAILED
             rec.runtime = "still_present"
             rec.error = TeachingError(
@@ -545,7 +583,14 @@ def run_close(
             Location(),
         ))
 
-    instances = [_close_one(t, list_fn, delete_fn, mcp_fn, mcp_ok) for t in targets]
+    # The post-delete CONFIRM must be a FRESH read. When the PRODUCTION default seam is in play, the
+    # discovery ``list_fn`` may serve from a rim-served snapshot (J9), so the confirm shells fresh via
+    # ``list_runtimes_fresh``; an INJECTED seam (tests) serves both — its identity is not the default,
+    # so the confirm uses it unchanged (a stateful fake reflects the delete exactly as before).
+    confirm_list_fn: ListFn = (
+        _box.list_runtimes_fresh if list_fn is _box.default_list_runtimes else list_fn
+    )
+    instances = [_close_one(t, list_fn, delete_fn, mcp_fn, mcp_ok, confirm_list_fn) for t in targets]
     verdicts = {i.verdict for i in instances}
     overall = (FAILED if FAILED in verdicts else
                CLOSING if CLOSING in verdicts else CLOSED)

package/dist/composer/verbs/fund.py

@@ -67,7 +67,16 @@ from ._box import (
     McpFn,
     wallet_match,
 )
-from ._layout import canonical_wallet_json, resolve_wallet_json
+from ._layout import (
+    KIND_MANAGED,
+    KIND_MANUAL,
+    canonical_graph_path,
+    canonical_releases_dir,
+    canonical_staged_dir,
+    canonical_wallet_json,
+    resolve_wallet_json,
+    wallet_kind,
+)
 from .close import (
     _dig,
     _find_list,
@@ -197,10 +206,15 @@ def _read_wallet_json(path: Path) -> Optional[dict]:
 
 
 def _write_wallet_json(path: Path, *, strategy: str, wallet: str, strategy_id: str,
-                       budget: float, created_at: Optional[str]) -> None:
+                       budget: float, created_at: Optional[str],
+                       kind: Optional[str] = None) -> None:
     """Record the minted wallet BESIDE the strategy (the resumable-by-artifact marker). Written
     BEFORE polling so an interrupted run resumes at step (a). ``created_at`` is an INJECTED value
-    (no wall-clock in the Python core) — None when the caller omits it."""
+    (no wall-clock in the Python core) — None when the caller omits it.
+
+    ``kind`` (J3) stamps the strategy KIND marker. It is OMITTED entirely for a MANAGED wallet
+    (``kind`` None or ``"managed"``) so the managed payload is byte-for-byte what it was pre-J3;
+    only a MANUAL wallet carries ``"kind": "manual"`` (absence = managed, back-compat)."""
     path.parent.mkdir(parents=True, exist_ok=True)
     payload = {
         "strategy": strategy,
@@ -209,6 +223,8 @@ def _write_wallet_json(path: Path, *, strategy: str, wallet: str, strategy_id: s
         "budget": budget,
         "created_at": created_at,
     }
+    if kind == KIND_MANUAL:
+        payload["kind"] = KIND_MANUAL
     path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
 
 
@@ -237,6 +253,7 @@ class FundResult:
     strategy_id: Optional[str] = None
     budget: Optional[float] = None
     available: Optional[float] = None
+    kind: str = KIND_MANAGED      # J3: "managed" (a graph strategy) | "manual" (wallet, no runtime)
     pre_action: str = ""          # the unmistakable money-mutation line (create path only)
     errors: list[TeachingError] = field(default_factory=list)
     message: str = ""
@@ -255,6 +272,7 @@ class FundResult:
             "strategy_id": self.strategy_id,
             "budget": self.budget,
             "available": self.available,
+            "kind": self.kind,
             "pre_action": self.pre_action,
             "error_count": len(self.errors),
             "errors": [e.to_dict() for e in self.errors],
@@ -267,6 +285,8 @@ class FundResult:
             lines.append(f"  {self.pre_action}")
         if self.strategy:
             lines.append(f"  strategy   : {self.strategy}")
+        if self.kind == KIND_MANUAL:
+            lines.append("  kind       : manual (wallet only — NO graph/runtime)")
         if self.wallet:
             lines.append(f"  wallet     : {self.wallet}")
         if self.strategy_id:
@@ -275,7 +295,11 @@ class FundResult:
             lines.append(f"  budget     : ${self.budget:,.2f}")
         if self.message:
             lines.append(f"  {self.message}")
-        if self.verdict == FUNDED and self.wallet:
+        if self.verdict == FUNDED and self.wallet and self.kind == KIND_MANUAL:
+            lines.append("  next: manual strategy is live — place/manage positions directly via "
+                         "MCP on this wallet (the sanctioned path for this kind). `composer status "
+                         f"{self.strategy or '<name>'}` shows it; `composer close` tears it down.")
+        elif self.verdict == FUNDED and self.wallet:
             lines.append(f"  next: `composer install <target>` (auto-binds this wallet), or "
                          f"`--wallet {self.wallet}`.")
         if self.verdict == PENDING:
@@ -300,12 +324,14 @@ def run_fund(
     *,
     out_dir: Optional[str] = None,
     created_at: Optional[str] = None,
+    manual: bool = False,
     mcp_fn: McpFn = _box.default_mcp_call,
     sleep_fn: Callable[[float], None] = time.sleep,
     poll_attempts: int = 3,
     poll_interval: float = 5.0,
 ) -> FundResult:
-    """Create + fund a strategy's wallet (see module docstring)."""
+    """Create + fund a strategy's wallet (see module docstring). ``manual=True`` (J3) funds a MANUAL
+    strategy — a wallet with NO graph/staged unit — resolving the target as a bare strategy name."""
     # (0) --budget gate — REQUIRED, EXPLICIT, ≥ the platform floor. Never derived or split.
     if budget is None or _num(budget) is None or float(budget) < MIN_BUDGET:
         shown = "(missing)" if budget is None else f"${float(budget):,.2f}" if _num(budget) is not None else repr(budget)
@@ -319,6 +345,14 @@ def run_fund(
         ), budget=_num(budget))
     budget = float(budget)
 
+    # J3: a MANUAL strategy has NO graph / no staged unit — it is a funded wallet under composer's
+    # record system, nothing more. It resolves by NAME (the target IS the strategy) and refuses to
+    # collide with a managed strategy. The managed path below is byte-for-byte unchanged.
+    if manual:
+        return _run_fund_manual(target, budget, base_state_dir, mcp_fn=mcp_fn,
+                                created_at=created_at, sleep_fn=sleep_fn,
+                                poll_attempts=poll_attempts, poll_interval=poll_interval)
+
     # (1) resolve the staged unit → strategy name (+ version for attribution). Bare strategy names
     # and canonical graph paths resolve through the layout (G8b).
     staged = _resolve_staged(target, out_dir, base_state_dir)
@@ -326,7 +360,8 @@ def run_fund(
         return _refused(target, "", TeachingError(
             "CMP200", "the fund target is not a staged unit (no manifest.json found).",
             "Point `composer fund` at a `composer deploy` staging dir, or pass the graph file plus "
-            "`-o <staging-dir>`. Run `composer deploy <graph> -o <dir>` first.",
+            "`-o <staging-dir>`. Run `composer deploy <graph> -o <dir>` first. (To fund a MANUAL "
+            "strategy — a wallet with no graph — use `composer fund <name> --manual --budget N`.)",
             Location(),
         ), budget=budget)
     try:
@@ -344,11 +379,82 @@ def run_fund(
         return _verify_existing(target, strategy, budget, existing, existing_path, mcp_fn, created_at)
     wj_path = wallet_json_path(base_state_dir, strategy)  # canonical write path for a fresh mint
 
+    # (b)+(c) preflight balance → create → record → poll (shared with the manual path; kind=None so
+    # the managed wallet.json payload is byte-unchanged).
+    return _mint_wallet(target, strategy, budget, wj_path, mcp_fn=mcp_fn, created_at=created_at,
+                        sleep_fn=sleep_fn, poll_attempts=poll_attempts, poll_interval=poll_interval,
+                        kind=None)
+
+
+# --------------------------------------------------------------------------- manual strategy (J3)
+
+def _manual_artifacts_present(base_state_dir: str, strategy: str) -> bool:
+    """True when a MANAGED strategy already owns ``strategy``'s canonical dir — a graph.yaml record,
+    a staged/ deploy output, or a releases/ install tree. These are the graph-lifecycle artifacts a
+    manual strategy NEVER has, so their presence is the collision signal (CMP262)."""
+    return (
+        canonical_graph_path(base_state_dir, strategy).is_file()
+        or canonical_staged_dir(base_state_dir, strategy).is_dir()
+        or canonical_releases_dir(base_state_dir, strategy).is_dir()
+    )
+
+
+def _run_fund_manual(target: str, budget: float, base_state_dir: str, *,
+                     mcp_fn: McpFn, created_at: Optional[str],
+                     sleep_fn: Callable[[float], None], poll_attempts: int,
+                     poll_interval: float) -> FundResult:
+    """Fund a MANUAL strategy (J3): the target IS the strategy name; there is no graph to resolve.
+    Refuses (CMP262) if the name already belongs to a MANAGED strategy; otherwise mints + funds a
+    wallet exactly like the managed path, stamping the ``kind: manual`` marker into wallet.json."""
+    strategy = str(target)
+
+    existing_path, _layout = resolve_wallet_json(base_state_dir, strategy)
+    existing = _read_wallet_json(existing_path) if existing_path is not None else None
+    managed_wallet = existing is not None and wallet_kind(existing) != KIND_MANUAL
+
+    # COLLISION: never overwrite a managed strategy (graph/staged/releases, or a managed wallet.json).
+    if _manual_artifacts_present(base_state_dir, strategy) or managed_wallet:
+        return _refused(target, strategy, TeachingError(
+            "CMP262", f"{strategy!r} already exists as a MANAGED strategy (it has a graph / staged "
+                      f"/ installed artifacts or a managed wallet.json) — it cannot be re-created as "
+                      f"a manual wallet.",
+            f"Pick a DIFFERENT name for the manual wallet, or manage {strategy!r} as the graph "
+            f"strategy it already is (`composer status {strategy}` shows its lifecycle; "
+            f"`composer fund {strategy} --budget N` funds its graph-bound wallet). `--manual` only "
+            f"creates a brand-new wallet-only strategy.",
+            Location(),
+        ), budget=budget, kind=KIND_MANUAL)
+
+    # A pre-existing MANUAL wallet.json → the idempotent verify path (never re-fund).
+    if existing is not None:
+        res = _verify_existing(target, strategy, budget, existing, existing_path, mcp_fn, created_at,
+                               kind=KIND_MANUAL)
+        res.kind = KIND_MANUAL
+        return res
+
+    wj_path = wallet_json_path(base_state_dir, strategy)  # canonical write path for a fresh mint
+    return _mint_wallet(target, strategy, budget, wj_path, mcp_fn=mcp_fn, created_at=created_at,
+                        sleep_fn=sleep_fn, poll_attempts=poll_attempts, poll_interval=poll_interval,
+                        kind=KIND_MANUAL)
+
+
+# --------------------------------------------------------------------------- mint (shared b+c)
+
+def _mint_wallet(target: str, strategy: str, budget: float, wj_path: Path, *,
+                 mcp_fn: McpFn, created_at: Optional[str],
+                 sleep_fn: Callable[[float], None], poll_attempts: int, poll_interval: float,
+                 kind: Optional[str]) -> FundResult:
+    """Steps (b)+(c) shared by the managed + manual fund paths: preflight the visible balance,
+    create the wallet via MCP (a money mutation), record wallet.json BEFORE polling, then poll
+    strategy_list briefly for ACTIVE. ``kind`` stamps the wallet.json marker (manual only) and is
+    carried onto every FundResult so the caller/render/JSON knows the strategy kind."""
+    result_kind = kind or KIND_MANAGED
+
     # (b) PREFLIGHT the visible balance (no wallet yet).
     try:
         portfolio = mcp_fn("account_get_portfolio", timeout=_box._SUBMIT_TIMEOUT)
     except McpCredsMissing as e:
-        return _refused(target, strategy, _creds_error(e), budget=budget)
+        return _refused(target, strategy, _creds_error(e), budget=budget, kind=result_kind)
     except McpError:
         portfolio = None  # transport hiccup — proceed unverified (create fails loud if truly short)
     available = _available_usd(portfolio)
@@ -363,16 +469,19 @@ def run_fund(
             "topping up more. To add funds: deposit USDC to your embedded wallet, or bridge from "
             "Hyperliquid. The composer NEVER bridges or splits the budget for you.",
             Location(),
-        ), budget=budget, available=available)
+        ), budget=budget, available=available, kind=result_kind)
 
     # (c) CREATE — a money mutation. State exactly what is being done (no --yes; conversational).
     sname = sanitize_strategy_name(strategy)
+    manual_note = (" MANUAL strategy (a funded wallet with NO graph/runtime — direct MCP position "
+                   "edits are the sanctioned path)." if kind == KIND_MANUAL else "")
     pre_action = (f"CREATING WALLET — strategy={strategy!r}, budget=${budget:,.2f}, "
                   f"funding source=your embedded balance (Hyperliquid + EVM), "
                   f"attribution skillName={COMPOSER_SKILL_NAME!r} (v{COMPOSER_SKILL_VERSION}), "
                   f"strategyName={sname!r}."
                   + ("" if available is not None
-                     else " (balance could not be pre-verified; the backend will reject if short.)"))
+                     else " (balance could not be pre-verified; the backend will reject if short.)")
+                  + manual_note)
 
     def _create(with_name: bool):
         # skillName = the AUTHORING skill (never the strategy); skillVersion = the composer version
@@ -397,26 +506,28 @@ def run_fund(
         res = _create(with_name=True)
     except McpCredsMissing as e:
         return _refused(target, strategy, _creds_error(e), budget=budget, available=available,
-                        pre_action=pre_action)
+                        pre_action=pre_action, kind=result_kind)
     except McpError as e:
         msg = str(e)
         if any(c in msg for c in _NAME_ERR_CODES) or "name" in msg.lower():
             try:
                 res = _create(with_name=False)  # naming is best-effort — retry unnamed
             except McpError as e2:
-                return _create_failed(target, strategy, budget, available, pre_action, e2)
+                return _create_failed(target, strategy, budget, available, pre_action, e2,
+                                      kind=result_kind)
         else:
-            return _create_failed(target, strategy, budget, available, pre_action, e)
+            return _create_failed(target, strategy, budget, available, pre_action, e,
+                                  kind=result_kind)
 
     sid = _strat_id(res)
     if not sid:
         return _create_failed(target, strategy, budget, available, pre_action,
-                              f"create returned no strategyId: {res!r}")
+                              f"create returned no strategyId: {res!r}", kind=result_kind)
     addr = str(_strat_wallet(res) or "")
 
     # Record BEFORE polling — an interrupted run resumes at step (a), never double-funds.
     _write_wallet_json(wj_path, strategy=strategy, wallet=addr, strategy_id=sid,
-                       budget=budget, created_at=created_at)
+                       budget=budget, created_at=created_at, kind=kind)
 
     # Poll strategy_list BRIEFLY for ACTIVE (bounded; still pending → PENDING, not a failure).
     for attempt in range(max(1, poll_attempts)):
@@ -429,10 +540,11 @@ def run_fund(
         cur_addr = str(_strat_wallet(s) or "") if s else ""
         if status == "ACTIVE" and cur_addr:
             _write_wallet_json(wj_path, strategy=strategy, wallet=cur_addr, strategy_id=sid,
-                               budget=budget, created_at=created_at)
+                               budget=budget, created_at=created_at, kind=kind)
             return FundResult(
                 target=target, verdict=FUNDED, strategy=strategy, wallet=cur_addr,
-                strategy_id=sid, budget=budget, available=available, pre_action=pre_action,
+                strategy_id=sid, budget=budget, available=available, kind=result_kind,
+                pre_action=pre_action,
                 message=f"wallet ACTIVE and funded with ${budget:,.2f}.",
             )
         if attempt < poll_attempts - 1:
@@ -440,7 +552,7 @@ def run_fund(
 
     return FundResult(
         target=target, verdict=PENDING, strategy=strategy, wallet=addr, strategy_id=sid,
-        budget=budget, available=available, pre_action=pre_action,
+        budget=budget, available=available, kind=result_kind, pre_action=pre_action,
         message=f"wallet created (strategyId {sid}) and funding; not ACTIVE yet.",
     )
 
@@ -448,8 +560,13 @@ def run_fund(
 # --------------------------------------------------------------------------- sub-flows
 
 def _verify_existing(target: str, strategy: str, budget: float, rec: dict, wj_path: Path,
-                     mcp_fn: McpFn, created_at: Optional[str]) -> FundResult:
-    """Step (a): a wallet.json already exists — verify it via strategy_list, never re-fund."""
+                     mcp_fn: McpFn, created_at: Optional[str],
+                     kind: Optional[str] = None) -> FundResult:
+    """Step (a): a wallet.json already exists — verify it via strategy_list, never re-fund.
+    ``kind`` (the recorded marker) is PRESERVED across any in-place backfill so a manual wallet
+    never loses its marker on a re-run."""
+    rec_kind = kind if kind is not None else wallet_kind(rec)
+    result_kind = rec_kind or KIND_MANAGED
     rec_wallet = str(rec.get("wallet") or "")
     rec_sid = rec.get("strategyId")
     try:
@@ -457,7 +574,7 @@ def _verify_existing(target: str, strategy: str, budget: float, rec: dict, wj_pa
         mcp_ok = True
     except McpCredsMissing as e:
         return _refused(target, strategy, _creds_error(e), wallet=rec_wallet,
-                        strategy_id=rec_sid, budget=budget)
+                        strategy_id=rec_sid, budget=budget, kind=result_kind)
     except McpError:
         strategies, mcp_ok = [], False
 
@@ -470,23 +587,23 @@ def _verify_existing(target: str, strategy: str, budget: float, rec: dict, wj_pa
         if addr and addr != rec_wallet:
             _write_wallet_json(wj_path, strategy=strategy, wallet=addr,
                                strategy_id=rec_sid or _strat_id(s), budget=budget,
-                               created_at=rec.get("created_at") or created_at)
+                               created_at=rec.get("created_at") or created_at, kind=rec_kind)
         return FundResult(
             target=target, verdict=FUNDED, strategy=strategy, wallet=addr or rec_wallet,
             strategy_id=rec_sid or _strat_id(s), budget=rec.get("budget", budget),
-            message="wallet already funded and ACTIVE (no-op).",
+            kind=result_kind, message="wallet already funded and ACTIVE (no-op).",
         )
     if s is not None and status and status not in CLOSED_STATUSES:
         return FundResult(
             target=target, verdict=PENDING, strategy=strategy, wallet=addr or rec_wallet,
             strategy_id=rec_sid or _strat_id(s), budget=rec.get("budget", budget),
-            message=f"wallet still initializing (status {status}).",
+            kind=result_kind, message=f"wallet still initializing (status {status}).",
         )
     if not mcp_ok:
         # Could not reach MCP to confirm — do NOT declare stale; re-run once reachable.
         return FundResult(
             target=target, verdict=PENDING, strategy=strategy, wallet=rec_wallet,
-            strategy_id=rec_sid, budget=rec.get("budget", budget),
+            strategy_id=rec_sid, budget=rec.get("budget", budget), kind=result_kind,
             message="could not reach MCP to verify the recorded wallet — re-run `composer fund`.",
         )
     # Found closed, or not present in the live set at all → the recorded wallet is stale.
@@ -497,7 +614,7 @@ def _verify_existing(target: str, strategy: str, budget: float, rec: dict, wj_pa
         f"for {strategy!r}, delete the stale marker `{wj_path}` and re-run `composer fund`. If you "
         f"believe it is still open, check MCP `strategy_list` (it may be filtered out as terminal).",
         Location(),
-    ), wallet=rec_wallet, strategy_id=rec_sid, budget=budget)
+    ), wallet=rec_wallet, strategy_id=rec_sid, budget=budget, kind=result_kind)
 
 
 def _creds_error(exc: Exception) -> TeachingError:
@@ -510,10 +627,10 @@ def _creds_error(exc: Exception) -> TeachingError:
 
 
 def _create_failed(target: str, strategy: str, budget: float, available: Optional[float],
-                   pre_action: str, err) -> FundResult:
+                   pre_action: str, err, kind: str = KIND_MANAGED) -> FundResult:
     return FundResult(
         target=target, verdict=FAILED, strategy=strategy, budget=budget, available=available,
-        pre_action=pre_action,
+        kind=kind, pre_action=pre_action,
         errors=[TeachingError(
             "CMP233", f"MCP `strategy_create_custom_strategy` failed: {str(err)[:200]}.",
             "No wallet was created (nothing to clean up). Re-run `composer fund` — it is safe "

package/dist/composer/verbs/install.py

@@ -104,16 +104,35 @@ class CreateResult:
 CreateFn = Callable[[str, str], CreateResult]
 
 
+# The one production shell-out that had NO timeout: a hung `runtime create` is the field-reported
+# "deploy verify hang" class. Bound it generously (create legitimately runs 30-60s: MCP connect,
+# strategy + DSL init, supervisor + scaffold spawn — senpi-commands.ts uses a 60s gateway timeout),
+# but never UNBOUNDED. 120s leaves ample headroom over the gateway's own 60s while still failing loud.
+_CREATE_TIMEOUT = 120
+
+
 def _default_create(runtime_yaml_path: str, runtime_id: str) -> CreateResult:
     """Production seam: shell out to the FROZEN consumer in PATH mode (never --content — the
     external scanner needs the recipe dir the -p path carries; index.ts:1088, senpi-commands.ts:94).
-    Captures stdout/stderr so the verdict is parsed truthfully rather than inherited to the tty."""
+    Captures stdout/stderr so the verdict is parsed truthfully rather than inherited to the tty. A
+    hang is bounded at ``_CREATE_TIMEOUT`` (J9): a timeout returns an honest non-zero CreateResult
+    (mirroring ``_box._run_cli``'s timeout shape) so the mapper teaches it rather than hanging."""
     openclaw = os.environ.get("OPENCLAW_BIN", "openclaw")
-    proc = subprocess.run(  # noqa: S603 — fixed argv, no shell
-        [openclaw, "senpi", "runtime", "create", "-p", runtime_yaml_path, "--runtime-id", runtime_id],
-        capture_output=True,
-        text=True,
-    )
+    argv = [openclaw, "senpi", "runtime", "create", "-p", runtime_yaml_path, "--runtime-id", runtime_id]
+    try:
+        proc = subprocess.run(  # noqa: S603 — fixed argv, no shell
+            argv,
+            capture_output=True,
+            text=True,
+            timeout=_CREATE_TIMEOUT,
+        )
+    except subprocess.TimeoutExpired:
+        return CreateResult(
+            -1, "",
+            f"`openclaw senpi runtime create` timed out after {_CREATE_TIMEOUT}s "
+            f"(runtime {runtime_id!r}). The box may be wedged or the gateway unreachable — re-run "
+            f"`composer install` (idempotent); if it persists, check `openclaw senpi runtime list`.",
+        )
     return CreateResult(proc.returncode, proc.stdout or "", proc.stderr or "")