Settings

Section 15.10's configurable settings - persisted in app_settings and actually consumed: default_risk_pct is the default the Risk Management screen's "open from live signal" form falls back to when no risk % is given, and in_app_notifications_enabled genuinely gates whether a paper position close creates a notification below.

Notifications (0)

Section 18's in-app channel. Telegram, email, and browser push are not built - each needs either a provider credential this session can't create on your behalf (a Telegram bot token, SMTP credentials) or substantial additional infrastructure (a service worker for Web Push), so they are deferred rather than faked.

Not yet implemented

• Telegram, email, and browser push notifications (Section 18) - see above.
• Auth, secret management, rate limiting, and audit logging (Section 19) - this platform has no login today; Phase 10's scope, not Phase 9's.