Reference

Before any figure is shown, the local book is compared against the broker’s. If they disagree, a banner says so and trading is refused until a person explains it.

WhyEvery number on this dashboard is computed from the local model. If the model has diverged from reality, a good day reported on top of it is a good day you cannot believe — so the check comes first, cannot be hidden, and the settings page refuses a panel list that leaves it out.

Six rungs: BACKTEST, PAPER, SHADOW, PROPOSE, EXECUTE, SIZE. A strategy is on exactly one of them, and the rung decides how far its signal is allowed to travel without you.

WhyAutonomy is earned per strategy against mechanical gates, never granted by a feeling that something is working. PROPOSE — an order prepared and a human confirming it — is where this system sits by default, and the book argues SIZE should never be granted at all.

Two stances ship — passive and aggressive — and you can build a custom one from them. They differ in sizing, concentration and turnover, and in nothing else.

WhyA ceiling a preference can lift is a preference, not a ceiling. The hard limits are imported from wherever the rule already lives rather than retyped here, and nothing in this application — not the UI, not the API — can raise one.

The system may refit what it measures — cost models, fitted rates, its own notes. It may not change a limit. Anything that is on neither list is refused rather than guessed at.

WhyOver HTTP that refusal is a 403 rather than a 400: it is not a malformed request, it is one only a person may make. A system that could quietly raise its own ceiling on a good week would have no ceiling.

A cost model is marked ASSUMED or MEASURED. Crypto costs are assumed, because no crypto round trip has been measured here — so crypto is capped at PAPER no matter how well it backtests.

WhyCost is a property of a rate, and an unfitted rate means the backtest describes a business nobody has shown exists. Replacing an assumed number with a confident-looking one to unblock a gate is the specific mistake this label exists to stop.

Three instances, three separate stores. The demo seeds fills and connects nothing. The local one reads your Keychain and trades against a simulator. The paper one reaches Alpaca paper, and is the only one that can send an order.

WhyOne shared store would mean a demo run overwriting a real record with seeded fills, noticed later. The status bar names which one you are reading, and says so again when it is showing the generated fixture because no local process is answering.

The screen you read before the open: reconciliation, then equity, realized P&L, drawdown and settled cash, then what the record says about where money went.

WhyOrdered by what would change your mind first, not by what is pleasant to look at. The tiles can be rearranged and the arrangement is yours — but the reconciliation banner is above all of it and cannot be moved or hidden.

Two books side by side: what this process believes it holds, and what the broker says it holds.

WhyThey are shown together rather than merged, because the merge is exactly where a discrepancy would disappear. A single reconciled number is the number you would have believed on the morning it was wrong.

Events sorted by whether you would act on them at 3am, not by severity.

WhyPaging on everything abnormal works out at 106 times a year — one every three and a half days — and an operator who is dismissing alerts from the lock screen inside a month has an alerting system that does nothing.

The session while it is happening: every held name marked to the current price, what today has done to it, and how old that price is.

WhyA day’s change needs yesterday’s close, and a feed can decline to give one. A row whose previous close is unknown is shown as unknown rather than as flat — zero reads as “this has not moved”, which is a claim about the market when the truth is a claim about the data. The age beside each mark is the same limit Confirm applies, so a refusal is legible before you press anything.

Where an order is written. Entering a ticket sends nothing: it is checked against the active profile, recorded with the reason you gave, and waits for a confirmation.

WhyThat wait is rung 3 of the ladder. The reason field is required because the question it answers is the one asked three weeks later about a position you do not remember opening — and a limit price is sent as a string, since a price that round-trips through a binary float cannot be reconciled.

A take-profit and a stop-loss, and the arithmetic that says what win rate they would need: p = (stop + cost) / (take + stop).

WhyUsually this is not shown, and it is the part that decides whether a strategy can make money at all. A target at or below the cost of the round trip breaks even at no win rate — which is a fact about the two numbers, available before any of it is traded.

Timers, triggers and thresholds that prepare tickets while you are not looking. A rule decides when; everything else is decided exactly as it is for an order you typed.

WhyA firing still waits for your confirmation unless that strategy has earned EXECUTE on a profile that allows it. Automation here buys attention, not permission — the limits, the ladder and the ticket book are unchanged by a thing having fired on its own.

Every closed round trip split three ways: the idea (signal), the execution (timing), and the size (sizing).

WhyThe three sum to realized P&L by construction rather than by rounding, which is what makes acting on the split safe. It names which part of the process to go and look at — it does not say the strategy is wrong.

Each strategy, the rung it is on, and every requirement it has not yet met for the next one.

WhyAll unmet gates are listed at once on purpose. Reporting one, fixing it, and resubmitting to discover the next is how a gate becomes a week. The gates are mechanical; promotion itself still takes a person.

What the stance costs per year in transaction costs alone, and which part of the round trip is binding.

WhyTurnover is the line that binds, not infrastructure. The same round trips at a different fitted rate move this figure by a factor of ten, which is why the model behind it carries its provenance and why the page names the rate it used.

What was believed, what measurement changed it, and when — every entry versioned.

WhyThe question it exists to answer is not what we think now; it is what this said when I made that decision. An entry the system may refit itself is marked as such, and one only a person may change refuses the system outright.

What you meant to do, kept beside what the system actually did.

WhyCompleting a task appends the completion rather than editing the row. A thing you meant to do and did not is evidence, and a list that tidied it away would read afterwards as a clean history that is not true.

What closed on each day, beside what you meant to do on it.

WhyThe realized figures are read from the same rows the attribution ledger reads, so this page cannot disagree with Attribution about what a day was worth. Two views of one fact, never two facts.

What you observed, dated, and left alone afterwards.

WhyThe value of a note is that it was written before the outcome was known. So nothing here is editable, and a second thought is a second note rather than a correction to the first.

Investments considered and not placed. Each carries a score for how completely the idea is written down.

WhyThat score is completeness, not quality. Nothing in this system can rank an idea, and a number implying it could would be read as advice the moment you were tired — so it measures the one thing it actually knows.

The active profile’s numbers and the ceilings they sit under, in Settings beside the profile that sets them. The kill switch is the Halt button in the status bar, on every page.

WhyThe ones marked fixed are not editable from anywhere in this application. Seeing the ceiling beside the dial is what stops the dial being read as the limit.

What is connected and what state it is in. It registers a broker, a bank or a wallet by naming the Keychain entry that holds the credential.

WhyIt refuses a credential outright rather than storing one, and that refusal is the page’s whole design. This dashboard can be served from a host you do not control, where a typed key crosses that host, lands in its logs, and ends up in a screenshot.

The active profile, and which panels the Overview shows. Two stances ship; a custom one starts from either.

WhyEverything editable here moves sizing, concentration or turnover. Nothing here moves a ceiling, and the panel list refuses to drop reconciliation — a screen you can configure into hiding the check is a screen that will eventually be configured that way.

The chip at the right of the status bar: your name, contact details, and how records are kept. Not the risk profile — that word is taken.

WhyIt stores four digits of an account number and refuses a full one, a credential or a tax identifier, cutting a pasted number down before writing. The warning is on the field before you type rather than after: a warning that appears once the value has been sent is a warning about something that already happened.

The switch beside the account chip. Dark is the default; light is remembered per browser once you ask for it, and the sidebar stays dark in both.

WhyDark is the design target because this is read before the open, often in a dim room, and that is the case that happens every day. The light palette is derived from it rather than drawn fresh — the semantic hues do not move, only their lightness — so a gain and a loss stay as far apart in either. Nothing consults your operating system’s preference.