Main work on the public desk from late July through mid-August 2026. Oldest entries at the bottom.
Accuracy, own scanner, and distribution
The desk is no longer only a Telegram log. Channel posts and a mechanical scanner now share one feed, with scored results on a public accuracy page.
Hit-rate strip on home, signals, and pair pages; full breakdowns on /accuracy by timeframe, side, source, and oscillator.
Source on every row (channel name, scanner, or both) plus filters for oscillator and regular vs hidden.
Quiet desk by default: H1+ and majors. M15 alt noise is behind “all timeframes”.
TradingView chart (RSI + MACD) and an M15 / H1 / H4 stack on each pair page.
Own closed-candle RSI/MACD scanner on top Binance USDT-M volume; M15 scanner hits are stored but not alerted.
Live % vs entry on each row; outcomes also snapshot 4h, 24h, and max adverse / favorable excursion.
Local watchlist, CSV export of the filtered desk, JSON/RSS fields for source and taxonomy, HMAC-signed webhooks.
Telegram Alerts stay out of the nav until a bot token is configured; RSS remains the public subscribe path.
Security lockdown
Public surfaces that should never have been in the web root were removed or blocked, and mutating admin actions now require CSRF tokens.
Removed the public Adminer install; session, state, and ingest logs moved outside the document root.
Database credentials now load from .env; MySQL password and ingest API key rotated.
Nginx denies ops scripts, node_modules, secrets, and the ingest endpoint except from private/local networks.
CSRF on login and admin forms; signal delete is POST-only; XSS escaping on message text and URLs.
Session cookies set HttpOnly / Secure / SameSite; session id regenerated on login.
Maintenance PHP is CLI-only. Sitemap generation no longer trusts Host from the browser.
Ingest recovery and a live signal desk
New divergences had stalled after early January. The Telegram user client and PHP ingest were repaired, then the public site grew from a static table into a live desk.
Client reconnect, NewMessage handler, and history catch-up on start and every few minutes.
Loopback ingest with the correct Host header so posts reach PHP even when public DNS is odd.
Two-hour pair/side/timeframe dedup so catch-up does not flood the table.
Live feed polling on home and signals; pretty URLs for /pair/BTC-USDT.
Public JSON and RSS APIs; entry snapshot plus horizon mark-to-market vs Binance futures.
Alerts subscribe UI (bot still optional), health checks, sitemap, and robots.
Design refresh
The site was restyled as a light paper desk. Layout bugs that caused horizontal scroll and stray grey edges on mobile were fixed.
Unified light theme across home, signals, and inner pages (hero stays dark).
Off-canvas nav that does not leave a scrollable gutter when closed.
Hero motion via background position instead of a scaled layer that overflowed.
Cropped hero art and offset grids so the top/left grey lines no longer show on phones.