Every order carries a client ID derived from the signal, the intent, the quantity and the day, so the same decision always produces the same ID. A retry after a timeout therefore reaches the broker as the same order rather than a second one, and an order whose outcome cannot be established halts new trading instead of being guessed at.

The backtester calls the production evaluate_entry at every simulated fill rather than a mirror of its arithmetic. A copy would have drifted within a quarter, and the backtest would then be measuring rules the live system no longer had. Two golden fixtures fail the build if a refactor changes what either path would do.

Twice every weekday the system compares what the broker holds with what its own database says it holds — positions, quantities and the resting exit orders that protect them. A discrepancy it cannot explain halts new entries and says why. It will adopt the broker's version of an order, but it never rewrites the quantity it recorded when the position was opened.

An unhandled error in a scheduled trading run — the nightly screen, the five daily manage runs, the two reconciles — marks that run failed and halts new entries, rather than carrying on with a partial picture. Exits are deliberately never blocked by a halt: whatever went wrong, a position that needs to close still closes.