Risk & discipline
Rules you write while calm, enforced when you aren't.
Daily loss, order count and fat-finger ceilings enforced in the order engine itself — plus circuit breakers over your own discipline, which can block an entry but never an exit.
The engine is the backstop, not the UI
Every cap below is enforced in the shared Rust order engine — the same code the desktop app, the chart overlays, the bots and the web build all route through. A screen can warn you; the engine is what actually refuses. There is no path around it, including the assistant.
Hard caps you set once
| Cap | What it does |
|---|---|
| Max loss per day | Blocks new entries once realized + open mark-to-market crosses your line, account-wide across every connected broker. A position carried overnight contributes only today's move, never its prior-day drawdown. |
| Max orders per day | A hard order-count budget for the day, shared across processes and preserved across restarts. |
| Confirm above N lots | A soft fat-finger prompt — asks before a large order. |
| Hard max lots per order | A hard ceiling: an order above it is REJECTED outright, engine-side, not merely confirmed. |
| Risk per trade (₹) | Sizes the Pulse plan card — quantity = risk ÷ stop distance. Advisory sizing, never a gate. |
Blank means off, and blank works: clearing a cap disables it, which the app confirms rather than quietly restoring the old value. Caps are shared between the desktop app and a running web gateway, and a stale window can never silently loosen a cap another one just tightened.
Circuit breakers — rules you write about yourself
A breaker is a plain AND of thresholds over discipline fields rather than market data: daily loss, consecutive stop-outs, trades today, size versus your own baseline, time of day. When the condition turns true it trips, with the action you chose:
- Warn — advisory only.
- Cool-off (N minutes) — new entries blocked for N minutes.
- Lock new entries — blocked until a wall-clock time, or the rest of the session.
A trip is durable and deliberately decoupled from the rule: disabling the rule that tripped does not lift a live cool-off — only deleting it does. That is the point of writing the rule while calm.
A breaker only ever reduces risk. Exits, kill-switch square-offs and reduce-only orders are never blocked. Entry GTTs and exposure-growing modifies are — an entry trigger can fire while the app is closed, which makes arming one during a cool-off worse than placing a live order, not better. Ships with no breakers active.
What a cap will never do
- Never block an exit. Reduce-only orders, square-offs and the kill switch bypass the entry gate entirely — you can always get out of a position, whatever state the account is in.
- Never fail open on a bad read. If P&L can't be read from a broker to evaluate the daily-loss line, entries are blocked, not waved through.
- Never carry yesterday's number. The day roll clears realized P&L and re-baselines carried open positions at the IST rollover.
The kill switch
One command cancels every working order and flattens every open position across all connected brokers, reduce-only, bypassing every entry gate. It is the one action the app guarantees is always available.