QuantumCat/Features/Risk & discipline
Risk & discipline
Rules you write while calm, enforced when you aren't.
Daily loss, order count and fat-finger ceilings enforced in the order engine itself — plus circuit breakers over your own discipline, which can block an entry but never an exit.
Risk & discipline · real build, recorded live
The engine is the backstop, not the UI
Every cap below is enforced in the shared Rust order engine — the same code the desktop app, the chart overlays, the bots and the web build all route through. A screen can warn you; the engine is what actually refuses. There is no path around it, including the assistant.
Hard caps you set once
| Cap | What it does |
|---|---|
| Max loss per day | Blocks new entries once realized + open mark-to-market crosses your line, account-wide across every connected broker. A position carried overnight contributes only today's move, never its prior-day drawdown. |
| Max orders per day | A hard order-count budget for the day, shared across processes and preserved across restarts. |
| Confirm above N lots | A soft fat-finger prompt — asks before a large order. |
| Hard max lots per order | A hard ceiling: an order above it is REJECTED outright, engine-side, not merely confirmed. |
| Risk per trade (₹) | Sizes the Pulse plan card — quantity = risk ÷ stop distance. Advisory sizing, never a gate. |
Blank means off, and blank works: clearing a cap disables it, which the app confirms rather than quietly restoring the old value. Caps are shared between the desktop app and a running web gateway, and a stale window can never silently loosen a cap another one just tightened.
Circuit breakers — rules you write about yourself
A breaker is a plain AND of thresholds over discipline fields rather than market data: daily loss, consecutive stop-outs, trades today, size versus your own baseline, time of day. When the condition turns true it trips, with the action you chose:
- Warn — advisory only.
- Cool-off (N minutes) — new entries blocked for N minutes.
- Lock new entries — blocked until a wall-clock time, or the rest of the session.
A trip is durable and deliberately decoupled from the rule: disabling the rule that tripped does not lift a live cool-off — only deleting it does. That is the point of writing the rule while calm.
A breaker only ever reduces risk. Exits, kill-switch square-offs and reduce-only orders are never blocked. Entry GTTs and exposure-growing modifies are — an entry trigger can fire while the app is closed, which makes arming one during a cool-off worse than placing a live order, not better. Ships with no breakers active.
What a cap will never do
- Never block an exit. Reduce-only orders, square-offs and the kill switch bypass the entry gate entirely — you can always get out of a position, whatever state the account is in.
- Never fail open on a bad read. If P&L can't be read from a broker to evaluate the daily-loss line, entries are blocked, not waved through.
- Never carry yesterday's number. The day roll clears realized P&L and re-baselines carried open positions at the IST rollover.
The kill switch
One command cancels every working order and flattens every open position across all connected brokers, reduce-only, bypassing every entry gate. It is the one action the app guarantees is always available.
On the real build
Trade X-ray · real build