- risk profiles
- One dropdown — NoLoss, Cautious, Balanced, Aggressive, Max — drives every cap as a live ratio of the run's budget: daily-loss limit, unrealised-loss stop, position and order caps, breakout policy, trailing-stop multipliers. NoLoss structurally refuses every loss-realising path.
- shared wallet
- All runs draw slices from one budget pool. Over-commitment is refused when you save, and halts entries at the daemon if it slips through. A wallet-level drawdown floor kills every run when equity falls below it and stays there for three ticks.
- sell at loss
- A per-run switch, off by default. Until you turn it on, the bot will hold inventory rather than realise a loss — a deliberate choice, not a forgotten one. sell_when_starved sells below cost only when the ladder has nothing left to trade with, and Flatten takes the bids and chases the price until the position is flat.
- server-side
- The caps live outside the strategy and outside the agent. A strategy bug or an over-eager AI proposal cannot raise a limit, clear a kill switch or liquidate a position.
- evidence
- Walk-forward sweeps over collected candle history — spacing, width, deployment policy, trend parameters — validate a setting before it is trusted with a live run. Sixteen sections of refit evidence and counting; ideas the data refuted stay refuted and are written up as such. Guardrails derived from them are computed into every refit proposal.
- alerts
- Kills, breakout halts, drawdown stops and stranded inventory go to your phone immediately; closed cycles the moment they book, with realised P/L; routine fills batched into digests so a burst is one message, not ten. A stop alert is never held back by the throttle.