Journal sync and remote monitor

What synchronizes

After reconciliation confirms a live entry and exit, the worker idempotently adds the completed trade to the paired Jorli journal. The immutable fact block records broker/account and order IDs, strategy version, deployment, signal version, actual fills, expected fills, entry/exit slippage, stop, target, adjustments, exit reason, P&L/cost attribution, and confirmation time. The source ID prevents a retry or restart from duplicating a trade.

Jorli labels these rows Broker confirmed. Fact fields cannot be edited or deleted. The trader can still add a personal followed-plan assessment, post-trade notes, day notes, and screenshots. Those user-authored fields remain visibly separate from broker facts. Existing daily, weekly, AI, mistake, and systematic-versus-discretionary summaries include synchronized trades.

Remote safety boundary

The monitor reads worker/deployment health, active authorization, risk alerts, positions, recent orders, and fills. It can request only:

• pause one deployment;
• activate the global emergency kill.

Each command has a unique client nonce and five-minute expiry. Duplicate requests return the same command. The agent audits receipt, performs the local operation, then returns observed state. Until that positive readback arrives, the UI shows the command as pending.

Remote access cannot create or activate a live deployment, edit a strategy, change credentials, increase risk, clear kill, or bypass the signed authorization envelope. Revoking a paired device immediately blocks later polls; remove its local credential with jorli remote unpair as well.