⚠️ Personal research and trading journal — not investment advice. The author does not provide licensed advisory services.
Every live system needs a way to turn itself off. Not just a stop-loss on a position — a way to stop the system from trading when something has gone wrong.
I have three levels of kill switch wired into my automated paper trading infrastructure. Here's how they work and why.
Why Kill Switches Exist
The failure mode that kills trading accounts isn't usually a single bad trade. It's a series of trades taken after the first bad trade, compounding the loss before the trader realizes the environment has changed.
In a momentum system, this is particularly dangerous. Momentum systems are calibrated for trending environments. When markets turn choppy or enter distribution phase, momentum signals generate whipsaw after whipsaw. Each loss is within the expected distribution — but the frequency of losses is outside it. A system with no environmental circuit breaker will keep trading until its statistical edge eventually returns, burning capital in the interim.
The kill switch is the circuit breaker. It's not about protecting against losing trades — those are expected and budgeted. It's about stopping execution when the sequence of losses signals that something has changed about the environment.
The Three-Tier Structure
Tier 1 — Position-level stop: 7% hard stop
Every individual trade has a hard stop loss. For most entries, the stop is set at the higher low of the base (the support level that defines the setup), capped at 7% from entry.
This is the normal loss per trade. It's expected. The system runs at 0.25% risk per trade, so a full stop-out is -0.25% of capital. Over 10 concurrent positions, a full drawdown on everything simultaneously would be -2.5%.
Tier 2 — Session-level stop: -10% portfolio drawdown (pause and review)
If total paper portfolio drawdown from its recent high exceeds 10%, the system stops taking new entries and flags for review. Existing positions remain open and follow their individual stops.
The review question: is the 10% loss within the expected distribution of a 20-year walk-forward period, or is it indicating a regime change? This distinction matters because the statistical edge was calibrated on all regimes — the 10% stop doesn't mean "regime changed," it means "require human confirmation before continuing."
Tier 3 — Strategy-level stop: -15% / -25% portfolio drawdown
At -15%, the system suspends new entries for the week and generates an alert. At -25%, the system shuts down entirely and requires manual restart with an explicit override.
These thresholds were derived from the walk-forward maximum drawdown distribution. -25% represents approximately the 95th percentile of historical monthly drawdown — hitting it in a short period suggests the system is failing, not just experiencing a bad stretch within its historical range.
The Implementation
In the live paper trading infrastructure, kill switches are checked at the start of each entry evaluation:
`python
def check_kill_switch(conn):
portfolio_dd = get_current_drawdown(conn)
if portfolio_dd < -0.25:
raise KillSwitchLevel3("System shutdown: -25% drawdown")
elif portfolio_dd < -0.15:
suspend_new_entries(conn, duration_days=7)
return False # No new entries this session
elif portfolio_dd < -0.10:
flag_for_review(conn)
return False # Pause until human confirms
return True # OK to proceed
`
The kill switch is also protected against double-fire on macOS sleep/wake cycles — a known issue where Python daemons can be instantiated twice when a Mac wakes from sleep. A singleton guard prevents the kill switch logic from running in two concurrent processes.
What the Kill Switch Protects Against
The primary protection is regime change. A momentum system's edge depends on the environment — confirmed uptrend, expanding ranges, sector rotation. When that environment ends, the edge evaporates temporarily.
The kill switch doesn't predict regime change. It responds to a loss sequence that is statistically unlikely under the system's historical distribution. That's a softer signal — it could be a bad luck sequence within normal distribution, or it could be regime change. The appropriate response is the same: stop, assess, restart consciously.
The kill switch also protects against system bugs. A mis-wired order, an incorrect stop calculation, a database corruption that generated phantom positions — any of these could produce losses that look like regime change. The kill switch catches them before they compound.
What It Doesn't Protect Against
Kill switches don't protect against gapping risk — a stock held overnight that opens down 40% on bad news. Individual position stops don't execute at the stated price when the market gaps through them. This is a known limitation; the system budgets for tail risk by keeping position sizes small (0.25% per trade, max 10 concurrent = 2.5% maximum concurrent risk).
They also don't protect against systematic miscalibration — if the win rate and R-multiples used to calibrate the kill switch thresholds are themselves overstated (due to backtest overfitting), the thresholds may be too loose. This is why the thresholds are derived from the walk-forward distribution, not the in-sample backtest distribution.
Track. Study. Wait. Strike.
Personal research and trading journal — not investment advice. The author does not provide licensed advisory services. — MOEasymmetry
Draft 2026-06-12. Source: Locked Nov 2026 config: 2 systems × 10 slots × 0.25% risk × kill -10/-15/-25. Implementation: intraday_session_us.py and intraday_session.py. Singleton guards: _enforce_singleton() pattern (see vault decisions/Daemon-Singleton-Guards.md). Walk-forward drawdown distribution: 20yr clean WF (vault validated-systems/). Kill thresholds: -10% (pause, human review), -15% (suspend 7d), -25% (full shutdown).