- risk profiles
- One dropdown — NoLoss, Cautious, Balanced, Aggressive, Max — drives every cap as a live ratio of the run's budget: daily-loss limit, unrealised-loss stop, position and order caps, breakout policy, trailing-stop multipliers. NoLoss structurally refuses every loss-realising path.
- shared wallet
- All runs draw slices from one budget pool. Over-commitment is refused when you save, and halts entries at the daemon if it slips through. A wallet-level max-drawdown stop kills every run when equity breaches the floor.
- sell at loss
- A per-run switch, off by default. Until you turn it on, the bot will hold inventory rather than realise a loss — a deliberate choice, not a forgotten one.
- server-side
- The caps live outside the strategy and outside the agent. A strategy bug or an over-eager AI proposal cannot raise a limit, clear a kill switch or liquidate a position.
- evidence
- Walk-forward sweeps over collected candle history — spacing, width, deployment policy, trend parameters — validate a setting before it is trusted with a live run. Guardrails derived from them are computed into every refit proposal.
- alerts
- Kills, breakout halts, drawdown stops and stranded inventory go to your phone immediately; closed cycles the moment they book, with realised P/L; routine fills coalesced into per-tick digests so a burst is one message, not ten.