feat(signals): share gateway configuration across strategy modules

README.md

@@ -37,11 +37,11 @@ This repository is the source of truth and distribution point for the scripts. G
 
 | Script | Target | Description | Source of truth | Install |
 | --- | --- | --- | --- | --- |
-| Binance Strategy 29 Bollinger signals | Binance Futures | Annotate native loaded candles and optionally show the authenticated cross-timeframe server summary; standalone or alongside orderbook 2.7.199+ | This repository | [Install][install-binance-strategy29-bollinger] |
+| Binance Strategy 29 Bollinger signals | Binance Futures | Annotate native loaded candles; remote summaries belong to the CorsairQuant signal client | This repository | [Install][install-binance-strategy29-bollinger] |
 | Binance orderbook one-click order entry | Binance Futures | Click an orderbook price, infer the current open/close tab, fill quantity, and submit an order with a multiplier panel | This repository | [Install][install-binance-orderbook-trade] |
 | Binance Futures data panel | Binance Futures | Overlay open interest, long/short ratios, funding rate, basis, and directional signals | This repository | [Install][install-binance-trading-data] |
 | Binance CoinMarketCap data panel | Binance Futures | Show CoinMarketCap valuation, supply, and liquidity data for the current symbol | This repository | [Install][install-binance-coinmarketcap-data] |
-| Binance Strategy 27 event annotations | Binance Futures | Draw VPS-computed order-flow observations and exploratory compound candidates on the matching one-second chart | This repository | [Install][install-binance-strategy27-events] |
+| Binance CorsairQuant signal client | Binance Futures | Configure one gateway for Strategy27 event annotations and Strategy29 cross-timeframe summaries | This repository | [Install][install-binance-strategy27-events] |
 | Auto refresh | Any page | Refresh selected pages on a configurable schedule | This repository | [Install][install-auto-refresh] |
 | CoinMarketCap valuation labels | CoinMarketCap | Label and highlight circulating market cap and FDV / total valuation in the Chinese UI | This repository | [Install][install-coinmarketcap-valuation-helper] |
 | m3u8 downloader | Video pages | Enhanced m3u8 detection and export workflow for allowlisted video sites | This repository | [Install][install-m3u8] |
@@ -61,9 +61,10 @@ This repository is the source of truth and distribution point for the scripts. G
 - Displays values and simple directional signals inside the trading page.
 - Reduces context switching between Binance and external data pages.
 
-### Binance Strategy 27 event annotations
+### Binance CorsairQuant signal client
 
 - Reads only the authenticated loopback gateway through an SSH local forward.
+- Updates the existing Strategy27 installation in place and retains its private gateway configuration for all remote modules.
 - Adds no Binance market-data WebSocket or Binance API key to Chrome.
 - Draws bounded, transient event markers and objective four-force notes on the matching one-second chart.
 

README.zh-CN.md

@@ -35,11 +35,11 @@
 
 | 脚本 | 适用场景 | 说明 | 源码真源 | 安装 |
 |---|---|---|---|---|
-| 【自写】Binance Strategy 29 布林带信号 | Binance Futures | 标注原生图表已加载 K 线，并可选显示经认证的服务端跨周期摘要；可单独运行或与订单簿 2.7.199+ 共存 | 本仓库 | [安装][install-binance-strategy29-bollinger] |
+| 【自写】Binance Strategy 29 布林带信号 | Binance Futures | Annotate native loaded candles; remote summaries belong to the CorsairQuant signal client | 本仓库 | [安装][install-binance-strategy29-bollinger] |
 | 【自写】Binance 订单簿单击下单 | Binance Futures | 单击订单簿价格，按当前开仓/平仓 tab 自动填数量并执行下单，内置数量倍率面板 | 本仓库 | [`点击安装`][install-binance-orderbook-trade] |
 | 【自写】Binance 合约交易数据面板 | Binance Futures | 在合约交易页面叠加浮动面板，定时拉取交易数据（持仓量、多空比、资金费率等）并显示当前值 + 多空信号 | 本仓库 | [`点击安装`][install-binance-trading-data] |
 | 【自写】Binance CoinMarketCap 数据面板 | Binance Futures | 在 Binance 合约页面显示当前币种的 CoinMarketCap 估值、供应量和流动性数据 | 本仓库 | [`点击安装`][install-binance-coinmarketcap-data] |
-| 【自写】Binance Strategy 27 事件标注 | Binance Futures | Draw VPS-computed order-flow observations and exploratory compound candidates on the matching one-second chart | 本仓库 | [`点击安装`][install-binance-strategy27-events] |
+| 【自写】Binance Strategy 27 事件标注（CorsairQuant 信号客户端） | Binance Futures | Configure one gateway for Strategy27 event annotations and Strategy29 cross-timeframe summaries | 本仓库 | [`点击安装`][install-binance-strategy27-events] |
 | 【自写】定时刷新指定页面 | Any page | 指定页面按设定时间自动刷新 | 本仓库 | [`点击安装`][install-auto-refresh] |
 | 【自写】CoinMarketCap 估值口径命名 | CoinMarketCap | 在中文币种页面左上角统计区标注并高亮流通市值和 FDV / 总估值 | 本仓库 | [`点击安装`][install-coinmarketcap-valuation-helper] |
 | 【改写】m3u8-downloader | Video pages | m3u8 下载增强脚本，仅在白名单视频站启用 | 本仓库 | [`点击安装`][install-m3u8] |
@@ -59,7 +59,7 @@
 - 使用浮动面板展示当前值和多空信号。
 - 适合在交易页面内快速判断市场结构，不需要频繁切换数据网站。
 
-### Binance Strategy 27 事件标注
+### Binance CorsairQuant 信号客户端
 
 - 只通过 SSH 本地转发读取带认证的本机网关。
 - 不在 Chrome 中新增 Binance 行情 WebSocket，也不使用 Binance API Key。

docs/binance-strategy27-events-development.md

@@ -1,4 +1,4 @@
-# Binance Strategy 27 Event Annotations
+# CorsairQuant Signal Client and Strategy27 Event Annotations
 
 This document owns the Strategy 27 gateway, chart-rendering, and entity
 contracts. Generic Codex/tool timeout and connection policy belongs to the global
@@ -11,6 +11,23 @@ V10 live projection. The VPS remains the only market-data and event-analysis
 authority. The userscript opens no Binance market-data WebSocket, uses no
 Binance API key, and does not recalculate the four force groups.
 
+Version 0.5.0 uses the existing installation as the CorsairQuant signal client.
+Strategy29 remote ownership starts only after the local-only Strategy29 companion
+publishes a valid page-scoped readiness record. Without it, the host reports
+`waiting_for_companion` and leaves any legacy Strategy29 remote owner untouched.
+This handshake is separate from one-time preference migration, so later reloads
+continue to use the host's saved choices. Update both existing installations and
+reload to complete a staged upgrade.
+The historical installed script name is retained to preserve update identity.
+Its private gateway URL and secret are shared by the Strategy27 consumers and
+the independently controlled Strategy29 remote summary. The installation namespace
+and update URLs remain unchanged; update the existing installation in place.
+The retained `strategy27GatewayOrigin` and `strategy27GatewayAuthSecret` storage
+keys are the single credential source, avoiding a second setup during migration.
+The standalone Strategy29 script continues to own its local detector and has no
+gateway request or configuration permissions. New remote modules must receive
+the host's private settings adapter rather than creating another credential store.
+
 The script reads an authenticated, loopback-only long-poll endpoint through an
 SSH local forward. It draws transient entities only when the Binance route,
 TradingView symbol, and `1S` chart interval all match the requested Strategy 27
@@ -21,13 +38,27 @@ symbol.
 1. Keep an SSH local forward open from `127.0.0.1:<local-port>` to the VPS
    Strategy 27 gateway on `127.0.0.1:8765`.
 2. Install `scripts/binance-strategy27-events.user.js` in Tampermonkey.
-3. Use the userscript menu to set the loopback gateway origin. The default is
+3. Use the CorsairQuant userscript menu to set the loopback gateway origin. The default is
    `http://127.0.0.1:18765`.
-4. Use the userscript menu to set the gateway installation secret. Tampermonkey
+4. Use the CorsairQuant userscript menu to set the gateway installation secret. Tampermonkey
    stores it in this script's private value storage; it is never embedded in
    source, URL parameters, chart text, console messages, or status text.
 5. Open the matching Binance futures route and select the one-second chart.
 
+The secret prompt is captured from the Tampermonkey sandbox before page code can
+replace the page prompt. No credential is passed through page globals, events,
+localStorage or diagnostics. Strategy29's only public migration record contains
+enabled state and panel coordinates, validates an exact schema and is copied once
+without overwriting destination preferences. Its summary follows the route symbol
+on any chart interval and remains visible while locally disabled. The host's
+existing context timer samples it; visibility and pagehide abort pending summary
+requests without resetting the retained cursor. A summary failure is contained at
+the module boundary and does not stop the independent Strategy27 consumers.
+
+Use the existing forward for `/v1/strategy29/status` and `/v1/strategy29/events`.
+The unified gateway's disabled module state is intentional and does not require
+another secret. Server monitoring and notification activation remain separate.
+
 The macOS operator machine keeps this forward under a `launchd` user agent so
 the SSH process is restarted after sleep, network changes, or a broken
 connection. The ordinary browser client treats `GM_xmlhttpRequest` transport
@@ -138,7 +169,7 @@ ADR 032 in CorsairQuant owns the server-side rule and transport contract. The
 browser does not reconstruct candidates from ordinary events or recalculate
 market evidence. The client, lifecycle, panel, native chart layer and optional-job
 controller are wired into the entrypoint and tested together. The source and
-generated install artifact are version 0.4.6 with identical metadata headers.
+generated install artifact are version 0.5.0 with identical metadata headers.
 The generated artifact passes syntax, release-contract and isolated execution
 checks, including candidate delivery, paired entities, clear and context stop.
 Binance operator-page validation remains outstanding. Server/gateway rollout

docs/binance-strategy29-bollinger-development.md

@@ -3,13 +3,15 @@
 ## Scope and Installation
 
 The standalone `binance-strategy29-bollinger.user.js` owns the local
-Bollinger/SMA60 observer and an optional read-only Strategy29 server summary.
+Bollinger/SMA60 observer. The CorsairQuant signal client, delivered through the
+existing Strategy27 installation, owns the read-only Strategy29 server summary.
 Source is `src/binance-strategy29-bollinger/`. The local observer reads only
-already-loaded native chart candles. The optional summary reads the authenticated
-loopback observer gateway; it does not call Binance market-data or account APIs,
+already-loaded native chart candles. The summary reads the authenticated
+unified loopback gateway; it does not call Binance market-data or account APIs,
 submit orders, rotate hidden charts, or add remote events as chart drawings.
 
-Install Strategy29 0.3.0 with orderbook 2.7.199 or later, or use it alone.
+Install Strategy29 0.4.0 with orderbook 2.7.199 or later, or use it alone.
+Install CorsairQuant signal client 0.5.0 for the remote summary.
 Do not combine it with the embedded observer in orderbook 2.7.198.
 After updating/disabling the old script, reload the page. An embedded observer
 is an explicit conflict: Strategy29 stops and displays an upgrade/reload notice.
@@ -18,8 +20,9 @@ save owner can block safe cleanup. This is not a supported compatibility mode;
 Strategy29 never removes old-script or user drawings.
 
 The orderbook runs in page context. Strategy29 runs in a Tampermonkey
-sandbox so its gateway secret remains in private userscript storage, and passes
-`unsafeWindow` explicitly to the chart runtime. The orderbook registers a
+sandbox with read access to its previous non-sensitive preferences, and passes
+`unsafeWindow` explicitly to the chart runtime. Gateway credentials belong only
+to the separate unified client's private storage. The orderbook registers a
 synchronous boolean drawing-busy predicate under
 `Symbol.for('jh-userscripts.chart-mutation-owners')`; it unregisters on permanent
 page teardown. A missing owner means there is no coordinated orderbook instance,
@@ -46,6 +49,9 @@ monitor failure with a property-read failure.
 If a host Proxy throws during rejection classification, the monitor stops that
 context and records `classificationFailed: true`; normal fatal errors record false.
 The frozen detector/core source and its direct invalid-context assertion remain unchanged.
+Time-alignment failure messages include both the requested and native returned
+timestamp. A later healthy context does not clear that historical evidence or
+establish why the native chart shifted the earlier marker.
 It describes the last fatal event, not necessarily the active context. It does not
 store stack traces, candles, requests or gateway credentials, and is never persisted
 or sent to the remote service. Recoverable snapshot races leave it unchanged.
@@ -76,10 +82,11 @@ coordinates fail explicitly. No credentials cross the page boundary.
 
 ## Optional Cross-Timeframe Server Summary
 
-The remote summary is disabled by default. Tampermonkey exposes three Strategy29
-menu commands: toggle the cross-timeframe summary, set the loopback gateway
-origin, and set the gateway secret. The origin contract is an explicit
-`http://127.0.0.1:<port>` origin; the default is `http://127.0.0.1:8729`. The
+The remote summary is owned by the CorsairQuant signal client. Its single
+gateway URL and secret configuration serves both Strategy27 and Strategy29,
+using the existing `http://127.0.0.1:18765` local forward. The Strategy29 module
+has one enable/disable menu and no separate gateway configuration. An inactive
+module still displays a discoverable panel without making requests. The
 secret is never stored in the page, URL, panel DOM, or debug diagnostics.
 
 When enabled, the panel follows only the current Binance route symbol but shows
@@ -118,14 +125,29 @@ missing or incompatible facts carry null metadata. Fail-closed selection may
 retain a complete prior-success group. Expired selection can originate from fresh
 or stale facts. Clock rollback does not invalidate otherwise coherent metadata.
 
-The current remote summary is disabled by default and has no panel while disabled.
 Authentication failure affects only the remote summary, not local chart detection.
-Strategy27 and Strategy29 currently use separate private userscript storage. The
-requested one-time gateway configuration across current and future strategies is
-a pending unified-client design, including credential ownership, module lifecycle
-and migration. Do not bridge credentials through page globals, localStorage or
-page events, and do not ask users to duplicate secrets as the long-term solution.
-A discoverable disabled-state entry is also pending, not implemented in 0.3.0.
+The unified client preserves the Strategy27 installation namespace, update URL and
+private gateway keys. Independent automatic updates require a readiness handshake:
+the host waits for the local-only companion before creating a remote panel. A
+legacy companion retains its panel and polling until refresh with both scripts
+updated. The new local-only runtime has a new singleton version and refuses to
+reuse a legacy remote-owning runtime. If the host has not updated, the companion
+shows a localized update/reload notice while local chart detection continues.
+The notice disappears when the host acknowledges ownership. Existing private
+host preferences win on subsequent reloads as well as initial migration.
+
+Update the existing installation in place. Strategy29's
+standalone entry is local-only and publishes only a versioned preference record
+containing enabled state and panel coordinates. The host validates its exact keys,
+copies missing preferences once into its own private storage and preserves existing
+host choices. This public record cannot supply gateway credentials, origins or
+event state. Both script load orders are supported; update both scripts before
+reloading. The host never installs or replaces the local detector singleton.
+
+The unified gateway reports `module_disabled` when the server module is intentionally
+off, `gateway_unavailable` when an enabled fixed backend cannot be reached, and
+`database_unavailable` only for the backend's own database failure. The panel labels
+these separately. Installing the unified client does not activate server monitoring.
 
 The browser polls status first and then consumes at most two event pages per
 scheduled poll. A new route requests `mode=latest&limit=20` for its canonical
@@ -136,7 +158,7 @@ advancing that cursor. `cursor_expired` clears only remote rows and requests a n
 latest snapshot. Rows are displayed and bounded by descending durable sequence,
 independent of detection timestamps. This requires the server's explicit latest
 query contract; a server rejecting it stops the remote context visibly.
-Publish the V2 gateway contract before the `0.3.0` client, then verify installed
+Publish the unified V2 gateway contract before the client, then verify installed
 source identity and reload before remote acceptance. Publication of either
 component does not enable the observer, gateway, or notifications.