Every build, and what changed in it.

Event-driven candidates no longer crowded out. The queue now considers time-sensitive, event-driven candidates before the ordinary per-cycle cap applies, instead of the cap potentially pushing them out.

Safer default on first run. When no configuration has been saved yet, the app starts in its conservative default rather than whatever was last used. Choosing between simulated and live account mode stays an explicit human decision.

Windows startup toggle. The app can start with Windows; the setting is on by default and can be turned off.

System tray. A tray menu opens the app and starts or stops the engine without changing the selected account mode. Closing the window keeps the app resident in the tray; Quit fully exits it.

Branding. The application window and tray icons use the Qovaryx artwork.

The evaluation harness was wrong, so we fixed it and retracted what it produced. Exit handling and real-world trading friction were not being accounted for correctly. Every figure produced by the earlier version of that harness is withdrawn and none of it appears anywhere on this site.

Risk profiles re-anchored. All profiles were re-derived against the corrected harness, including realistic execution friction. Sizing is bounded by the profile you choose, and the shared safety layer stays active in all of them.

An extra confirmation step before entry. Certain entries now require a second, independent confirmation before they are considered eligible. It rejects more than it admits, which is the point.

Several configurations demoted to observation-only. Three configurations stopped meeting the standard under the corrected harness and were moved to run without acting, so their behaviour can keep being measured.

Symbol groupings revised, and a probation group added. Symbols are grouped by how well the data supports evaluating them; a probation group holds names that are being watched before they are treated as ordinary.

Risk-card wording. Several risk descriptions in the app overstated what the software does. They were rewritten to say what is actually true.

Four risk profiles. Conservative, Standard, Aggressive and Extreme change position and concurrency limits. The two higher profiles require an explicit acknowledgement, and none of them can switch off the shared safety layer.

One dispatch and risk layer for every configuration. All the strategy configurations now share a single path that checks what the connected broker can actually do before anything is constructed.

Bring-your-own AI chat. Connect a hosted provider or a fully local model for analysis and chat. Provider credentials go in the operating system's protected store, and requests go only to the provider you picked. The chat surface cannot place an order.

Circuit breakers that apply to every profile. Daily-loss halts, concentration limits, drawdown acknowledgement, fill-quality monitoring and realistic execution costs stay on regardless of which profile you pick.

Explicit authority for every model. Each component is declared as acting, observing, providing context, or research-only. A component cannot influence an order unless it has been granted that role in writing.

Refusal checks wired end to end. Scheduled-event blackouts, disagreement checks, and a hard refusal path can all return "no action". A missing or contradictory input is not converted into a guess.

Release hardening. A bundled runtime, strict resolution of packaged files, clean per-user data locations and manifest verification replace the fallbacks that only ever worked on a development machine.

The broker selector showed the wrong name. A status overlay was writing its text into the broker list, so the first entry displayed a data-source label instead of the broker's name.

Broker choice did not persist. The settings panel was posting to an endpoint that did not exist and failing silently. Switching brokers now sticks across restarts.

The connection light lied. It now reports green only when the broker actually returns data, amber when the connection responds but is empty, and red on error — instead of showing green for a broker that was never connected.

Window and taskbar icon. The application identity is now set before the window is created, so Windows shows the brand mark in the taskbar, on pinned shortcuts and in Alt-Tab.

The full specialist set shipped in the public build. Every specialist model is trained from scratch rather than adapted from a borrowed foundation model, and all of them run on the local CPU.

A refusal layer over the combined result. Specialists are combined rather than trusted individually, and the refusal layer can demote a setup to "no action" before anything is submitted.

Advisory components stay advisory. Components not cleared to act remain observation-only unless deliberately enabled.

Update check reported the wrong state. The app now distinguishes a development workspace from an installed copy instead of returning a generic failure.