Your limit, not your firm's — sealed until the market closes.

deadman-guardian is a NinjaTrader 8 add-on that watches your day's P&L and, when you reach a personal loss limit you set stricter than your firm's, asks the platform to cancel your working orders and flatten everything, then reads the account back to check, and marks the account locked until the session rolls at 17:00 CT — a state whose only enforcement is to keep attempting to flatten: nothing here can prevent an order from reaching your broker. You cannot turn it off for the rest of the day. That is the product — and how often that check has actually confirmed is on the how-it-works page, in full.

Why believe any of this? The specification was written before the first line of C#, the implementation ships 25 of 26 named guarantees — and names the one it does not — and the same discipline is public in two repositories you can read today — including one where the published result is that nothing worked. The method, in full ↓
Built by Roberto Rodriguez — github.com/Roberto9210

Before anything else: four things it does not do

It does not bound your loss

It bounds your exposure and removes your discretion. Between reaching your limit and the position actually closing, the market keeps moving — and the closing is an attempt that has to be observed to succeed, not a step that is assumed to work. A gap or a fast market goes straight through that, and so does a flatten that does not verify. Three prop firms say the same thing about their own daily loss limits, in their own words; they are quoted on the compatibility page.

It does not work at every firm

Of sixteen firms researched, seven ban third-party automated tools in language that plainly covers this one — and three of those have now told us so in writing, by name. Four permit it outright, one runs a formal approval process we have applied to, and four are ambiguous enough that we have asked for a ruling and are waiting. Check the compatibility table before you install anything. If your firm prohibits it, don't install it — this table exists so you know before you write to us.

At two firms it can cause a violation you did not commit

Elite Trader Funding and Top One Futures require every trade to stay open at least ten seconds. If your limit is hit within ten seconds of entering, the guard flattens anyway — and that flatten breaches their rule. We do not defer the exit to satisfy a timer, because holding a position that is already past your limit is its own risk. The reasoning and the size of the exposure are on the compatibility page under the ten-second problem.

It cannot stop a determined you

Close NinjaTrader, delete the add-on, reopen: you are unprotected, and nothing in the design can prevent that. What it can do is make the bypass a deliberate, premeditated act that leaves a mark in an append-only record — instead of a moment of weakness at 14:30.

What it does

• One number, sealed for the day. You set a personal daily loss limit strictly smaller than your firm's. When you press Arm, the configuration is sealed with a hash until 17:00 CT. Every change is rejected — including one that would make the limit stricter.
• When you reach it, it acts in an order that survives a crash. The lockout writes its state to disk before the first order reaches your broker, then asks the platform to cancel the working orders, then to flatten, and then re-reads the positions — and if they are not actually flat it says LOCKOUT_INCOMPLETE and keeps trying rather than reporting a success it did not observe. What is re-read is the positions; the cancel has no confirmation of its own.
• A single flatten is not a lockout — and nothing is cancelled while locked. Entering the lockout sweeps the resting orders once; after that a new order reaches your broker and can fill. The guard then keeps trying to flatten and verifies rather than assumes — and the honest record, in episodes rather than cycles, is two lockouts ever — one of them under the code that ships today, and that one closed the position and verified it. The other, on 2026-08-26, ran 167 cycles without closing, for a cause removed the next day. Two is not evidence that it works. So it does not replace watching your platform: if it says it needs you, check the flatten yourself. What that means, in full →
• When it does not know, it stops. Account disconnected, P&L not computable, its own numbers disagreeing with NinjaTrader's beyond your tolerance, the system clock jumping: all of these block new entries and say why.
• Everything is written down, in a file you can verify without our code. Append-only, SHA-256 chained. Every arm, every breach, every cancel, every rejected attempt to loosen the limit.

How it works, with its limits stated on the same page →

What it is not

Not a strategy. Not signals. Not an optimiser. It never opens a position — the only orders it ever sends are cancels and flattens. It opens no socket: no telemetry, no cloud, no licence check, no auto-update. It reads your fills and your account's P&L, locally, and writes to three files on your disk.

The method, and why it is the whole pitch

The specification was written before the first line of C#, including a section titled "What this does not protect against." The implementation carries 26 named guarantees, and the conformance statement is "25 of 26" rather than "it works" — and it names the one that is not implemented. G8 says "orders after lockout are cancelled and logged", and since 2026-08-27 the guard deliberately does the opposite, because cancelling on sight cancelled its own flatten and four orders of the trader's. The guarantee's text is not rewritten to match the code: the gap is real, and rewriting it would delete the gap from view. That number is now computed from the specification rather than typed by hand — it read "26 of 26" for the six days from 2026-08-27 to 2026-09-02, after G8 stopped being implemented, because nothing obliged a hand-written number to go down. Two of the guarantees are about what the code is not: one asserts by reflection that the core library references no NinjaTrader assembly and no network stack; another that no double appears anywhere on its public surface, because money is decimal or it is a rounding bug waiting for a bad day.

The platform behaviour it depends on was measured inside the running NinjaTrader process, not assumed — including the finding that no pre-submit hook exists in 2,912 scanned types, so enforcement is detect-and-cancel and the pages here say so.

Same discipline, in public, in two repositories you can read today:

• deadman — the execution-safety library (deadman-kit), which ships tests that document its own limits.
• honest-strategy-search — the research method, where the published result is that nothing worked.

What this site is not

There is no price here, nothing to buy, no mailing list and no performance claim of any kind — this tool does not trade, so it has no returns to report. There are no trackers, no analytics and no cookies: this site loads nothing from a third party.