Order Execution and Position Truth

Smart routing, fill reconciliation, and the idempotency discipline.

§ IFrame

A signal pipeline ends with a sized order intent. Execution begins where the pipeline ends. The handoff is the moment the strategy stops being a quantitative description of the world and starts being capital at risk in the venue's queue.

Last Friday's lesson named five stages: ingest, normalize, filter, score, size. Each stage was an internal computation against data the operator controlled. Execution is not that. Execution is an outward act in a venue the operator does not control, against counterparties who do not consent to the operator's strategy, on a matching engine that reorders intents and fills partially and reports back through an API that can lie by omission.

Two operator failures dominate the execution surface. First, intent drift: the strategy decided to buy 1.0 BTC at midprice; the executor sent two orders for 0.5 BTC each at progressively worse prices because the first one partial-filled and the retry logic did not know the first had filled; the position is now 0.7 BTC at an average that is no longer the strategy's intent. Second, position-truth loss: the operator's internal book says the strategy holds 0.7 BTC; the venue says 0.65 BTC because a fill report was dropped on a websocket reconnect; the difference grows over hours until the operator discovers it in a reconciliation report or in a margin call. Today's lesson is about the operator discipline that prevents both.

§ IIFoundations — What Execution Owes the Strategy

Execution owes the strategy three things. It owes faithful translation of intent into venue actions. It owes a complete and ordered record of every venue action that resulted, with timestamps the operator can later compare against the strategy's expected path. It owes a position-truth layer that reconciles, on a cadence the operator chooses, the venue's view of holdings against the operator's view of holdings.

The first obligation is faithful translation. A strategy intent is a tuple of (instrument, side, size, price-band, urgency, expiry). The executor's job is to express that tuple in the venue's order types — limit, market, post-only, immediate-or-cancel, iceberg, time-weighted, volume-weighted — without distorting the strategy's intent through the choice of order type. Distortion is silent. A strategy that asked for "buy 1 BTC slowly over the next 30 minutes at no worse than 0.5% above midprice" expressed as a single TWAP slice over 30 minutes against the BTC-USD perp book at one venue, when the strategy meant the spot book across three venues, is a distortion. The cert candidate and the live operator both need to know that the order-type vocabulary is itself a translation layer with its own losses.

The second obligation is the complete and ordered fill record. Every venue emits fill events as the orders against its matching engine cross. The events arrive over a websocket that drops, a REST polling cycle that gaps, or an event-stream API that reorders. The operator's executor must reassemble those events into a per-strategy timeline that the post-trade analysis can read. The reassembly is not free. It requires sequence-number tracking, dedup on idempotency keys, gap-fill from REST when the websocket lost frames, and a discipline that distinguishes no message received yet from message received and recorded as no-fill.

The third obligation is position truth. The operator's internal book, the venue's account-state endpoint, and the wallet's on-chain state must agree to within a tolerance the operator declares. They drift apart for many reasons: dropped fill messages, dust from fee deductions in non-base currency, withdrawals the strategy did not authorize, exchange-side bookkeeping at end-of-day. The drift is not the problem. The undetected drift is the problem. Every adversarial-markets operator who has lost capital has lost some of it to position-truth loss they did not detect quickly enough.

§ IIIMechanism — Three Operator Disciplines

The three disciplines connect in series, but each emits an observability stream alongside its primary output. The streams are not optional. They are the layer the operator uses to detect intent drift and position-truth loss before either compounds.

§ IVWorked Example — The Polymarket Sized-Pair Execution

A concrete adversarial-markets execution example, drawing on the sized pair pattern from the AdiiX framework that DevOps + Quant practitioners run against Polymarket. The strategy: under cohort dispersion, the strategy sizes a long-short pair across two related markets rather than directing capital at one. The sized-pair intent is a tuple: long market A by $X, short market B by $X, both fill or both cancel.

The executor faces a venue that does not support cross-market atomic orders. The execution discipline becomes: send the two orders concurrently, hold both on a bracket — if both fill, accept; if one fills and the other does not within a deadline, cancel the unmatched one and report a partial-pair completion to the strategy for disposition. The strategy decides at that moment whether the half-pair is acceptable risk or must be flattened.

The executor's per-side state machine: intent received → child slice computed → venue order sent → venue order acknowledged → fill events arriving → terminal state. The two state machines run concurrently; the bracket is a third state machine that watches both and decides at the deadline. The fill log carries both order IDs, both venue acknowledgments, every fill event from both, and the bracket's terminal decision.

The reconciliation overlay: every minute, position truth queries Polymarket's /positions endpoint and compares against the executor's per-strategy book. The drift tolerance is one share — Polymarket positions are integer-quantized. A drift of two shares triggers the alert.

The numbers from a clean day of this strategy: the strategy fires forty pair intents across the trading day. Thirty-six pairs fill both sides within the bracket window. Two pairs fill one side; the bracket cancels the unmatched and notifies the strategy. Two pairs fill neither side and expire. The fill log carries roughly two hundred fill events. The reconciliation overlay fires zero alerts. The position-truth view at end-of-day matches the venue exactly. This is what working execution looks like on a venue.

The numbers from a day where execution is almost working: the strategy fires forty pair intents. The reconciliation overlay fires three alerts during the day. The first alert is diagnosed as a dropped fill message — the executor missed it because the websocket reconnected during a network blip; the background REST sweep caught it within the next minute. The second alert is also a websocket drop, same pattern. The third alert is the dangerous one: the venue's /positions shows a position the executor's book does not have. Diagnosis reveals a child slice the executor never sent — a race condition in the slicer caused the child to be dropped between computed and sent. The strategy's intent to long market A by $X became long market A by $0.85X. The discrepancy is small. The lesson is large: an executor that does not have the position-truth overlay would not have caught the missing slice for hours or days.

§ VConnection to Prior Lessons

This lesson builds on three threads. From the 2026-05-22 signal-pipeline lesson, this lesson picks up where that one ended — the same backtest-fidelity, observable-selectivity, deterministic-computation discipline extends into execution. From the 2026-05-26 secret-management lesson, this lesson inherits the credential discipline for venue API access: each child slice carries HMAC or API-key authentication; the secrets module that held the agent's credentials is the same module that holds the venue's. From the 2026-05-28 runtime-threat-detection lesson, this lesson inherits the audit-log discipline: the Go middleware wrapping the executor's HTTP client emits hash-chained logs of every request and response, and those logs are what the operator reads when reconciliation finds drift.

§ VIConnection to Today's Dev Lesson

The Rust lesson today encodes the order-lifecycle state machine in the type system. The executor's sent and unacknowledged state is a distinct Rust type from acknowledged with venue order ID; the terminal state is a sealed trait whose only constructors are reachable from acknowledged. The compiler refuses to let the executor act on an unsent order or believe a fill event for an unsent order. The state machine the Ops lesson describes in prose becomes a state machine the Rust compiler enforces.

The type-state discipline applies symmetrically to the bracket. The bracket is parameterized over the side-A state and the side-B state; the bracket can only fire its terminal decision when both sides have reached terminal state or the deadline has passed. The compile-time check is the operator's first line of defense against the kinds of race conditions that drop child slices in the worked example above.

§ VIIClosing

Execution is the layer where the strategy meets the venue. Smart routing translates intent into venue actions without distortion. Fill reconciliation reassembles the venue's response into a per-strategy timeline. Position truth verifies the operator's internal book against the venue's view on a cadence the operator chooses. Three disciplines; one operator obligation: keep the strategy's intent and the strategy's actual position in continuous, observable correspondence.

The cert candidate who learns these disciplines passes the practical-systems portion of any quant or crypto operator interview. The live operator who runs them keeps capital. The strategy that does not have them silently bleeds basis points until the day the alert fires and the basis points have become a quarter of the book. Examine well. The signal pipeline produces the intent; the executor honors it; the position truth witnesses it.