Money-safety bug: subscribe() changed paper_mode on a paper→live promotion
but left auto_trade untouched. A user could flip Auto-Trade ON while in paper
mode (harmless — SystemControl only checks 'subscribed', not paper), then
promote to live and add an API key — at which point the next high-confidence
Trump signal opens a REAL position, carried over from a switch they flipped
when it cost nothing.
Now: when paper_mode transitions True→False AND auto_trade is on, force
auto_trade=False. The user must re-enable it explicitly while live (a signed,
intentional action). Risk-raising transition resets the dangerous switch —
standard financial-product safety. Frontend handleUpgradeToLive copy updated
to say Auto-Trade is turned off on the switch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
k
752652f463