See opportunity, risk, and execution logic before the trade

One control stands the account down

Emergency stop is per broker account and needs no special setup: turn it on and every automatic path refuses to dispatch, with the reason and the actor written to the audit log.

Losing days automatically shrink the machine

A drawdown governor tracks each account's session peak. Past the threshold it halves position size and raises the score a candidate has to clear. It is one-directional by construction — it can only make trades smaller or harder to take, never larger.

Every decision leaves a receipt you can re-open

Decisions, gate blocks, broker commands, and Supervisor thesis verdicts are written to a hash-chained audit log — each entry sealed against the one before it, so an edited history is detectable rather than a matter of trust.

One shared code path for practice and real money

Every risk gate that runs on practice runs on real money too — one shared code path, not two implementations. A parity test covers a defined matrix of risk gates across all four execution paths and fails when any path carries a weaker gate than another. Where real and practice differ deliberately — real spreads are genuinely wider, so the real-account spread ceiling has a floor — the effective value is shown on your configuration page.

On a real account, automatic closing stays locked by default

Automatic opening runs inside your account's limits. Automatic close and modify ship switched off and need an explicit per-account unlock, and a stop-loss modify is tighten-only by construction — there is no setting that lets it widen your protection.