Going live is not a deploy. It is a decision to let software spend your money while you are not watching. This is the list I run every time, in order.
The checks
- Every failure path has a class and a test. Transient, terminal, ambiguous. No path falls through to a bare retry.
- Risk counters live outside the code they limit. A trade cap enforced inside the function placing trades is not a cap.
- The running config matches the committed config. Log the hash at startup and refuse to start on a mismatch.
- The kill switch fires in a simulation of today's worst case. Test it, do not assume it.
- Paper fills are priced against real order books. Mid-price fills flatter everything downstream.
- The clock is right, and the calendar knows about holidays. Including expiry days and special sessions.
- Data gaps raise an alarm rather than a shrug. A sequence check on the feed, and a loud failure when it breaks.
- Position state survives a restart. Kill the process mid-session in paper mode and see what comes back.
- You can replay the day. If you cannot reconstruct what the bot saw, you cannot debug what it did.
Check eight is the one that caught me. The process restarted cleanly and then opened a second position because it had forgotten the first.