Sync website settings (account/risk/top/leverage) to Telegram alert loop

- New GET/POST /api/alert-config: server-side store the background alert loop reads each 5-min cycle
- _alert_loop now reads account/risk_pct/user_leverage/top from this store, falling back to today's exact original defaults (ALERT_ACCOUNT secret, 6x, 1%, top-30) until the user actively changes a setting
- Bounds-clamped server-side (top 1-50, leverage 1-100x, etc.)
- static/index.html: saveSettings() (existing localStorage persistence, fires on real change/blur only) now also POSTs to /api/alert-config

Fixes: background alert loop previously ignored the dashboard entirely and
used fixed literals, causing Telegram alerts to fire on symbols/sizing the
website never reflected.

main.py

@@ -59,15 +59,47 @@ _SYNTHETIC_PATTERNS = [
 def is_synthetic(symbol: str) -> bool:
     return any(p.search(symbol) for p in _SYNTHETIC_PATTERNS)
 
+
+# ── Website -> Telegram alert config sync ──────────────────────────────────
+# Root cause fixed here: the dashboard's account/risk/top/leverage settings
+# used to live only in the browser tab and were never seen by the background
+# alert loop, which hardcoded its own numbers instead. This in-memory store
+# is the shared source of truth both sides now read/write. It only ever
+# contains a key once the user has ACTIVELY changed that setting on the
+# website — untouched keys fall back to today's existing defaults below, so
+# nothing changes for anyone who never touches the settings. Resets on Space
+# restart/redeploy, same as the existing dedup cache (see telegram_alert.py).
+_alert_config: dict = {}
+ALERT_CONFIG_BOUNDS = {
+    "top": (1, 50),
+    "user_leverage": (1.0, 100.0),
+    "risk_pct": (0.01, 100.0),
+    "account": (1.0, 10_000_000.0),
+}
+
+
+def _clamp(key: str, value: float) -> float:
+    lo, hi = ALERT_CONFIG_BOUNDS[key]
+    return max(lo, min(hi, value))
+
+
 async def _alert_loop():
-    """Background task: scan every 5 min and fire Telegram alerts for high-confidence cards."""
+    """Background task: scan every 5 min and fire Telegram alerts for high-confidence cards.
+
+    account/risk_pct/user_leverage/top scan-depth are read fresh from
+    _alert_config each cycle so the website's live settings govern what the
+    background loop does (fixes the website/Telegram discrepancy — previously
+    this loop ignored the dashboard entirely and used fixed literals). Falls
+    back to the original defaults (ALERT_ACCOUNT secret, 6x, 1%, top-30) for
+    any setting the user hasn't touched yet.
+    """
     from telegram_alert import send_alert, prune_sent_cache, send_raw_message
-    # Read account size from HF Secret — defaults to 10 if not set
+    # Fallback account size from HF Secret — used only until the website sets a custom one
     try:
-        alert_account = float(os.environ.get("ALERT_ACCOUNT", "10"))
+        default_account = float(os.environ.get("ALERT_ACCOUNT", "10"))
     except ValueError:
-        alert_account = 10.0
-    logger.info("Alert loop starting — account=$%.2f", alert_account)
+        default_account = 10.0
+    logger.info("Alert loop starting — default account=$%.2f (website can override live)", default_account)
 
     await asyncio.sleep(60)  # give app time to fully boot before first scan
     loop_count   = 0
@@ -78,11 +110,15 @@ async def _alert_loop():
         try:
             src = get_source()
             secondary = get_secondary()
-            candidates, _synth_excluded = rank_universe(src, src.min_vol, 30)
+            alert_account  = _alert_config.get("account", default_account)
+            alert_risk_pct = _alert_config.get("risk_pct", 1.0)
+            alert_leverage = _alert_config.get("user_leverage", 6.0)
+            alert_top      = int(_alert_config.get("top", 30))
+            candidates, _synth_excluded = rank_universe(src, src.min_vol, alert_top)
             for c in candidates:
                 try:
-                    card = score_symbol(src, c["symbol"], alert_account, 1.0,
-                                        secondary=secondary, user_leverage=6.0)
+                    card = score_symbol(src, c["symbol"], alert_account, alert_risk_pct,
+                                        secondary=secondary, user_leverage=alert_leverage)
                     conf   = card.get("confidence", 0)
                     vetoed = card.get("vetoed", False)
                     if conf >= 8.8 and not vetoed:
@@ -218,6 +254,36 @@ def status():
         return JSONResponse({"ok": False, "error": str(e)}, status_code=503)
 
 
+@app.get("/api/alert-config")
+def get_alert_config():
+    """Current website->Telegram alert sync settings. is_custom=False means
+    the background loop is still using its original hardcoded defaults."""
+    return {
+        "account": _alert_config.get("account"),
+        "risk_pct": _alert_config.get("risk_pct"),
+        "top": _alert_config.get("top"),
+        "user_leverage": _alert_config.get("user_leverage"),
+        "is_custom": bool(_alert_config),
+    }
+
+
+@app.post("/api/alert-config")
+def set_alert_config(account: float = None, risk_pct: float = None,
+                      top: int = None, user_leverage: float = None):
+    """Called by the dashboard whenever the user changes a setting. The
+    background alert loop picks these up on its next 5-min cycle."""
+    if account is not None:
+        _alert_config["account"] = _clamp("account", account)
+    if risk_pct is not None:
+        _alert_config["risk_pct"] = _clamp("risk_pct", risk_pct)
+    if top is not None:
+        _alert_config["top"] = int(_clamp("top", top))
+    if user_leverage is not None:
+        _alert_config["user_leverage"] = _clamp("user_leverage", user_leverage)
+    logger.info("Alert config updated from website: %s", _alert_config)
+    return {"ok": True, "config": _alert_config}
+
+
 @app.get("/api/scan")
 def scan(top: int = 8, min_volume: float = None, account: float = 100000,
          risk_pct: float = 1.0,

static/index.html

@@ -2739,6 +2739,22 @@ function saveSettings() {
   const out = {};
   SETTINGS_FIELDS.forEach(f => { out[f.id] = $(f.id).value; });
   try { localStorage.setItem(SETTINGS_KEY, JSON.stringify(out)); } catch(e) {}
+  syncAlertConfig();
+}
+
+// Push account/risk/top/leverage to the server so the background Telegram
+// alert loop uses the same settings as the dashboard, instead of its own
+// fixed defaults. Only fires from real user edits (saveSettings only runs on
+// 'change'/'blur'), never automatically on page load — so nothing changes
+// for the alert loop until you actually touch a setting here. Fire-and-forget:
+// failures never block or affect the on-screen scan.
+function syncAlertConfig() {
+  const account = +$('account').value || 10000;
+  const risk = +$('risk').value || 1;
+  const top = +$('top').value || 8;
+  const userLev = +$('user-leverage').value || 6;
+  const qs = `account=${account}&risk_pct=${risk}&top=${top}&user_leverage=${userLev}`;
+  fetch(`/api/alert-config?${qs}`, { method: 'POST' }).catch(() => {});
 }
 
 function loadSettings() {