The 176-trade study split every SPX trade by direction vs the daily SMA20 trend: with-trend +$5.7k, counter-trend −$14.6k. One filter separated profit from disaster.

Rule: every strategy gets a trend gate. Above the daily SMA20 → sell put spreads only; below → call spreads only. No exceptions, no "this dip looks different."

ITM/near-ATM entries contributed −$12.2k of the study's losses. Fat credits up front, but the strike gets run over constantly.

Rule: strikes live OUT of the money, scaled to volatility — v2.2 uses a VIX-scaled cushion (min 15 pts), v3 uses 1.1× the remaining-day expected move. Never chase credit by moving closer to price.

With ~$150–190 average wins and $750–1,600 losses, the system needs 84–87% wins just to break even. You can't entry-tweak your way out of that; you have to shrink the worst loss.

Rule: the server premium stop closes any spread whose buyback cost hits 2.5× its entry credit — capping the tail near −$750–800 regardless of chart timeframe. Built 2026-07-30 after this exact analysis.

Pine "Est P&L" tables book profit-targets the instant price touches the proxy. Reality check: the server once held 87 of 109 EXIT_PT signals because the real quote hadn't reached the target.

Rule: haircut every on-chart win rate by ~6–10 points (98% table ≈ 88–92% live) before deciding anything. And test across multiple timeframes — a bigger timeframe loads more history and shows the number decaying toward truth.

For weeks the SPX panel showed +$2.9k / 100% wins. It was fiction: expired spreads were never settled in the ledger, so losses at expiry simply vanished. The settlement-true rebuild showed −$10.9k and a 40% win rate.

Rule: every position must reach a terminal state (closed OR settled at expiry) in the ledger. If a P&L number never shows losses, distrust it first — flattering numbers get audited hardest.

The agent's fetch_market function was a hardcoded stub — every "market regime" tag it ever produced came from a fake "VIX 15.2". Nobody noticed because the output looked plausible.

Rule: when wiring an AI or a report to data, prove the data path is real first (change a value upstream, watch it move downstream). Plausible-looking output is not verification.

OCC roots vary in width (SPXW one space, SPY    padded). Fixed-offset parsing mislabeled bear call spreads as puts — Victor caught it from the TradingView alerts, not the code review.

Rule: split option symbols on whitespace, never by position; the C/P letter in the leg is ground truth for direction (BULL = put credit spread, BEAR = call credit spread). And when the operator says the data looks wrong — believe them and verify.

The brains run under systemd with Restart=on-failure: they only auto-restart after a crash-like death. A polite kill (clean exit) took the stocks brain down for 8 minutes mid-session before anyone noticed.

Rule: restart with kill -9 <pid> (systemd revives it in ~10s) or sudo systemctl restart <service>. Always verify with a health check afterward. Do server surgery after hours (after 3:00p CT).

SSH sessions drop ("Connection reset by peer") and the terminal silently falls back to the Mac. The next pasted VPS command then runs locally — sudo fails with "Sorry, try again" and confusion follows.

Rule: before any server command, glance at the prompt. victor@spx-server = VPS. Victors-MacBook-Pro = your Mac; reconnect first.

Chart stops confirm on bar close (slow on big timeframes), see prices without real spreads, and die if the alert doesn't fire. The server sees real broker quotes every 10 minutes and doesn't care what chart anything runs on.

Rule: Pine signals propose; the server disposes. Profit-takes re-verified against real quotes, stops enforced by the premium-stop poller, GTC orders resting at the broker as the third safety net.

Two separate causes, one confusing symptom: (a) Chrome's page preloading tripped Cloudflare Access on prefetch requests; (b) assets served with max-age=0 occasionally loaded unstyled pages.

Rule: Preload pages OFF in Chrome; assets cached 1 hour via _headers — which also means CSS/JS changes take up to an hour to reach browsers; don't panic-debug a style change that "didn't deploy." If 403s recur: Zero Trust → Insights & Logs → Access for the blocked reason.

The dashboard's Basic Auth kept rejecting a correct password on iPhone: iOS was silently capitalizing the first letter of the username.

Rule: on mobile login problems, check what the keyboard actually typed before suspecting the server.

Rule: passwords, webhook secrets, and API keys never appear in chat, code, pages, or Pine scripts — scripts carry an empty secret field the operator fills in TradingView. The runbook documents where a secret lives, never the secret.

Rule: after any change — Victor's or Claude's — verify from the outside in: health endpoint answers, log line shows the new config, page renders, number matches. Proof over promises. If a step was skipped, say so plainly.

Rule: never block a session on a pending manual step (a sudo command, a TradingView alert, a DNS record). Stage the work, write the exact command for the operator, flag it, move on. Pending items live in the handoff doc until verified done.

Rule: on a live trading server, ship the smallest reviewable change, back up the files first (timestamped .bak), restart once, verify, and only then move to the next change. Never bundle unrelated surgery.