Every market-data request goes to the source you selected and to no other. A source the application does not recognise requests nothing at all rather than quietly routing to whichever vendor happens to be configured.

Guards against: data arriving from somewhere you did not choose, under terms you did not agree to, and a backtest that silently changed source halfway through its history.

The release feed is signed, and the application verifies it against a key it pinned earlier. A feed that fails verification shows no version, no link and no checksum — and a new signing key can only arrive through a different channel from the one serving the feed, so an update host can never vouch for itself.

Guards against: a tampered feed steering you to a download, which works precisely because it looks like a routine notification.

The Control Plane's routes are sorted into public, service and operator scopes by one explicit map, and anything the map does not name defaults to the most restricted scope. Adding a new door never makes it public by omission.

Guards against: the most common way a backend leaks — a new endpoint shipped before anyone decided who may call it.

A stop with no price reference of any kind is refused rather than placed at a guess. A safeguard that places an order on an assumption is not a safeguard — and every order the system places on its own traces back to something the user configured.

Guards against: an automatic protection creating the very loss it was meant to prevent.

A deployment whose logic reads a second series pauses its orders the moment that series is stale or missing at the current bar, and says which series and why. It resumes when the data does.

Guards against: trading on an unknown input — a condition evaluated against a price that stopped arriving, which reads exactly like a quiet market.

A preflight that cannot count what a job will cost shows no number rather than zero; a noise floor that was never measured is labelled unfloored rather than omitted; a figure computed from too few observations carries its sample size beside it.

Guards against: "this is free" and "this is fine" being read off a measurement that never happened.

Each write goes to its own temporary file and replaces the store in one step, and every read-modify-write holds the store's lock for the whole operation. This was learned the expensive way: two concurrent writes once shared one fixed temporary name, spliced a store together, and forty saved strategies were gone by the afternoon.

Guards against: a store that is half one write and half another, which is worse than either — it parses, so nothing notices.

A corrupt store is set aside under a timestamped name and reported, never overwritten with an empty one. Corrupt and missing are different facts, and treating them as the same is how a recoverable accident becomes a permanent one.

Guards against: the recovery path destroying the only evidence of what was there.

Records are addressed by number from several places at once — the current selection, portfolio legs, starred conditions, stress history. The counter never rewinds, so deleting a record can never hand its number to an unrelated one.

Guards against: a pointer that silently re-binds to a different strategy after a delete, which looks like the right record with the wrong contents.

Snapshots are scheduled by the age of the newest archive rather than a clock, each carries a checksum, and an archive without one is reported as unverifiable. The backup set is audited against the list of stores that must never be lost — an audit that has found whole directories missing from it before. Restoring is deliberately a command, not a button, and it refuses to write over a live tree.

Guards against: discovering that the backup was incomplete on the day you need it.

Every order, connection, deployment, risk event and configuration change is written to an append-only trail in which each record carries a hash of the one before it. The logging window shows the chain's integrity on every read — any edit, deletion or reordering breaks it and says where — with category filters, text search, a live poll and a CSV export of the filtered view.

It is local and never transmitted. The legal terms name it as something the operator of the online services never holds.

Guards against: a history that can be quietly corrected after the fact, which is no history at all.

Every operator act — conferring a tier, rotating a key, publishing a release — is recorded in the same chained form and verified every time it is read. A request its gate refused is counted, not recorded: an unauthenticated caller must never be able to grow the operator's own record.

Guards against: the commercial authority's history being editable by the people it records, and a stranger filling it with noise.

Brokerage and market data together: what was asked for, what actually crossed the wire, and what came back — a single fetch shown beside the individual requests it became. A summary of each can be mirrored into the audit trail so it survives beside the orders it fed.

Guards against: traffic nobody can account for, and "the data was wrong" with no record of what was asked.

Every standing rule keeps a fire ledger — including the rules in shadow mode, which record exactly what they would have done. Every research bot keeps a ledger of every decision it took and the reason, including every coercion of its configuration and every advisory it was given at deployment.

Guards against: automation whose behaviour can only be inferred from its results.

A day's summary can be written into the trail as a single record, so a day that has been reviewed stays reviewed — the digest cannot be regenerated later into something different.

Guards against: a summary that changes each time it is recomputed from data that has since moved.

The application diagnoses itself: one engine feeds both the warning panel you see while working and a daily report written in two forms — one for a person to read and one for a program to consume. Severity is honest in both directions: an empty data store is not "all clear", and a session that is closed at midnight is not an incident.

Guards against: two diagnoses of the same system disagreeing, because they were computed by two different engines.

It scans every dataset for ordering, price, split, volume, staleness and interior-gap defects and writes a dated report you can open from the logging window, or run on demand.

Guards against: an unadjusted split or a run of fabricated bars that flatters every backtest run over it.

When you ask for help, the diagnostic bundle is assembled field by field from a declared list — build identity, platform, configuration flags, counts and error types — and a field nobody declared is dropped, never sanitised. Exception messages are discarded outright, because a language runtime interpolates values into them. The whole bundle is shown to you as text before anything is sent.

Guards against: a help request that carries a position, a symbol or an account number off your machine by accident.

The workbench adds only the facts it owns — whether the application is reachable, how things are trending — to the application's own verdict, and keeps a ticket for each finding: critical when it is new or has come back, standing when it is known, resolved automatically when it has been absent for a day.

Guards against: a second opinion computed a different way that slowly drifts from the first, until the two disagree about whether anything is wrong.

Fills, rejects, disconnects, risk events and data events are derived from the audit trail rather than kept as a second record, so the alert you were shown and the record of what happened can never disagree. The badge turns red on an unseen error.

Guards against: a notification system with its own idea of what happened.

The live book, the connections, the alerts and the emergency controls — nothing else — on a page that does not depend on the full application being responsive.

Guards against: losing sight of a running book because the main window is busy with something else.

A slow action shows a turning ring and the present participle rather than a disabled button. A request that only sets a flag — finish the current cycle, stop at the next boundary — is drawn from the state the worker actually obeys, so "stopping" is never shown for a stop that was refused. The clock in the top bar becomes a ring while work runs.

Guards against: a button that looks pressed when nothing happened, and one that looks idle while something is still running.

Mining, stress sweeps, walk-forwards and every other heavy job pass through one broker that knows what is running and what it may still admit. A person's job pre-empts a research bot's in hundredths of a second, and the server can say at any moment exactly what is running.

Guards against: an unattended search slowing the interactive work of the person it works for.

The workbench samples the health of the suite on a cadence, keeps a bounded history and raises threshold alerts. The application appears in it as exactly one fact — whether the process is up — because its stores are not the workbench's to read. A monitoring write may never fail a request.

Guards against: every screen showing the present while nothing remembers the night.

Processes nobody launched are found by where they run, not by their name, and reported rather than killed — an unrecorded process is not provably abandoned. Dependencies are checked against what the interpreter can actually install, not merely against the newest release. And the version of record is derived from the engineering log and compared with what shipped, so a disagreement is shown rather than assumed away.

Guards against: a sixteen-day-old process nobody knew about, an "upgrade available" that can never be performed, and a release number nobody remembered to update.

Every surface that shows a backtest, a mined strategy, a stress run or a model output carries the standing hypothetical-results language in place, beside the numbers — not in a terms page nobody opens.

Guards against: a simulated figure being read as a track record.

The strategy explainer leads with the exits no condition controls — stops, trails, take-profits, time limits — and states plainly when there are none. When it was first run against the saved strategies, more than half had no stop of any kind, and a handful could never trade at all.

Guards against: a logic tree that looks complete while describing a plan the engine does not run.

A mined universe is read against an empirical null — the same search run on tapes with the signal destroyed. Until that floor exists, or once the search settings have moved away from the ones it was measured under, the result is labelled unfloored or stale, and the label says why.

Guards against: admiring the best of a thousand candidates without knowing what the best of a thousand looks like on pure noise.

A research bot is advised at deployment when its configuration will never ask whether a survivor beats simply holding the market. And a funnel stage whose floor rejected every candidate is recorded as barren and refuses to promote anything out of that cycle — "nothing was deleted" is not the same fact as "everything passed".

Guards against: a survivor promoted because every alternative was worse, rather than because it was good.

The limits sweep reports two different facts: whether your configuration is inside every published limit, and whether something bounds every limit at all. A known gap is not a breach — folding the two together leaves a signal that is always red, and a signal that is always red is not a signal.

Guards against: alarm fatigue hiding the one alarm that mattered.

Each governed window has a ceiling — the vendor's last legal value — and a default set deliberately under it. The ceiling is enforced in the one place every settings write passes through, so an edited file cannot step over it either, and a zero on a governed window means the ceiling rather than "off". A limit you can switch off is not a limit.

Guards against: a backfill quietly running at forty times the published rate because a setting was left at zero.

A budget per ten minutes, and a limit on repeated requests for the same instrument in a two-second window — the second one reachable by a single symbol's own history walk while the first is nowhere near its cap. Both are enforced, across every transport to the same account, and survive a restart.

Guards against: obeying one published rule while breaking another that nothing was counting.

Checking the window and recording the request used to be two steps, and every waiting thread could see the same free slot between them. They are one step under one lock now, measured at zero overshoot with thirty-two threads contending.

Guards against: a race that a comfortable safety margin was hiding, until the day it was not comfortable.

Past the account's allocation of live quote lines, a vendor simply stops sending. The application states a cap, refuses the newcomers by name when it is reached, and never drops a symbol already streaming to make room — described in full on the Live page.

Guards against: symbols that silently never tick.

The time from a signal to a fill is split into the application's leg — from the signal to the order being placed — and the broker's leg, from placement to fill. They are shown stacked, never summed into one figure, because one figure blames the market for a delay the machine caused.

Guards against: tuning the wrong half of a delay.

"Drift" is ambiguous: against the signal's price, the price when the order was placed, or the market on the bar it filled? The replay offers each as a named basis, defaults to execution — the fill against the market it executed into — and says that its two legs add up in money but not in basis points, rather than stacking two numbers that do not sum.

Guards against: charging a broker for time an order spent waiting inside the application.

A promoted strategy can be deployed to forward paper evidence for a stated number of bars, and live evidence is refreshed on a cadence against one high-water mark — so a deterioration is a fact the system fires on, not a feeling somebody has.

Guards against: a strategy that stopped working while everyone was looking at the backtest that said it would.

Calibration compares what testing predicted with what happened; deviance reads the audit trail for every guard you overrode and measures, after the fact, whether overriding it helped. Neither writes anything, blocks anything or changes a deployment.

Guards against: learning nothing from the difference between the plan and the outcome.