openclaw - 💡(How to fix) Fix gateway-quick-scalp covered-exit has naked-window risk between entry fill and exit placement

Problem

extensions/prediction-markets/src/gateway-quick-scalp.ts (lines ~2004–2160) implements a covered-exit safety pattern as fill-then-exit, not pre-armed exit. There is a measurable naked window where the operator holds the position with no exit order armed at the venue.

Specifically the sequence is:

1. L 2004–2026 — place entry order (with deterministic clientOrderId).
2. L 2031–2034 — await syncOrders + syncPositions in parallel.
3. L 2036–2042 — fetch fills for the venue order id.
4. L 2049 — re-sync execution snapshot.
5. L 2091–2117 — find live position; reconcile with reported fills (handles the case where the adapter saw a fill but venue position lags).
6. L 2135–2138 — compute coveredQuantity = min(filled, live).
7. L 2155+ — place exit. (Only now.)

The window between step 1 succeeding (entry filled at venue) and step 7 (exit placed at venue) is unbounded in the worst case (WS disconnect, network blip, gateway pause). During this window the position is naked — no profit-take, no stop, no liquidity at the venue.

Existing safety net (catches but does not prevent)

recordQuickScalpMissingExitCoverage (gateway-quick-scalp.ts:991, :2055, :2140) logs the entry-filled-without-exit case to the quick_scalp_missing_exit_coverage audit table so the operator gets an alert. This is excellent for diagnosis and post-mortems, but it cannot prevent real-money loss during the naked window.

In a fast-moving sports market (the primary Quick Scalp target — basketball, tennis, hockey), 2–5 seconds of unprotected long exposure during a swing can be the entire planned profit window.

Concrete fix

Use Kalshi V2 contract-limit order groups so entry + exit are placed atomically with contract-count linking. Specifically:

• Submit one order group (Kalshi V2 supports this) containing:
  • Entry leg: buy YES at limit price X for N contracts.
  • Exit leg: sell YES at limit price Y for N contracts (the planned profit target).
• The Kalshi exchange links the two by contract count: the exit cannot leave the matching engine claiming N contracts that aren't actually owned by the user after the entry fills.

This collapses steps 1–7 above into a single atomic submit. The naked window goes from "fill → exit place" duration to zero. If the entry doesn't fill, no exit gets placed. If the entry fills, the exit is already in the book.

Polymarket does not support this primitive today (CLOB V2 is per-order). For Polymarket the safest pattern is still pre-arm + tighten-after-fill (place a wide exit BEFORE the entry, then move it to the planned target after fill), not fill-then-exit.

Severity

Operator-impact: real-money loss during WS disconnect / network blip / gateway pause windows. Quick Scalp is the most active live-trading lane in Miles; its profit window is often ~10–30 seconds. A 2–5 second naked window is a non-trivial fraction of that.

Severity: high. This is the kind of bug where the audit log says "we tried our best" but the operator's P&L curve has a hole.