Execution model

The rules every execution follows.

• The venue is read before every leg. Unknown or stale state means nothing is sent.
• The audit record is written before the order is sent. If it cannot be written, the order is not sent.
• One order per leg. A network timeout is reconciled against positions and never re-sent.
• Only the venue position decides whether something filled.
• The first leg that is not fully confirmed stops the run.

Orders are immediate-or-cancel market orders with a price bound: buys cannot pay more than the bound, sells cannot receive less.