Live Position Monitoring and the Kill-Switch Discipline
Drawdown circuit breakers, staleness watchdogs, and the runtime risk-off surface.
§ IFrame
The pre-trade gate decides whether an intent becomes an order. After that decision nothing in yesterday's four lessons watches the order once it is alive in the market. The gate refused or forwarded; the executor routed and filled; the position now sits open with the operator's capital inside it. Between the fill and the close, the regime can turn, the data feed can die, a venue can halt, and a strategy that was correct at entry can bleed through a stop it never armed. The runtime watch is the small machine that holds the open position to account every second it stays open.
A signal pipeline reads the market. An executor acts on the market. The runtime watch reads the operator's own book. Its question is not should I enter and not did I execute well. Its question is narrower and more urgent: is the open position still inside the bounds the operator agreed to before it opened, and is the machinery that would tell me otherwise still alive. When the answer is no, the watch does not deliberate. It trips. The discipline of the trip is the whole of this lesson.
§ IIFoundations — What the Watch Owes the Book
The runtime watch owes the open book three guarantees and one terminal action.
The first guarantee is the drawdown ceiling. Every session opens with a loss budget the operator set before the first intent fired. The pre-trade gate already checks the budget at sizing time, but sizing-time arithmetic assumes the position behaves the way the prior says it will. The runtime watch checks the budget against what the position is actually doing, marked to the live tape, every tick. The ceiling is a number in base-currency loss. When realized-plus-unrealized loss crosses it, the watch trips. A strategy cannot vote to extend it mid-session; that vote is exactly the one a losing operator most wants to cast and most regrets casting.
The second guarantee is liveness of sight. A position the operator cannot see is a position the operator does not control. The watch depends on a market-data feed for the mark, an account feed for the fills, and a clock for both. Each of the three can stall without erroring. A feed that stops delivering ticks but holds its socket open looks healthy to a naive monitor and is blind in fact. The watch holds a heartbeat against each input and measures staleness as wall-clock time since the last accepted message. When staleness on any required input crosses its bound, the operator is blind on that input, and a blind operator with an open position is in a worse state than a flat one. Blind means flat.
The third guarantee is bounded reaction time. A ceiling the watch notices a minute late is a ceiling the watch did not hold. The watch runs on its own cadence, independent of the strategy loop and independent of the executor. Its tick budget is fixed and small, single-digit milliseconds for a short-horizon book and a second for a swing book, and the budget is measured, not assumed. A watch that cannot prove it ran inside its budget is itself a stale input, and the watch watches itself the same way it watches the feed.
The terminal action the watch owns is risk-off. Risk-off is the ordered sequence that takes the book from its current exposure to flat, or to a defined reduced state, without making the situation worse on the way. The naive version sends market sells for everything at once and discovers that a panic flatten into a thin book pays more slippage than the drawdown that triggered it. The disciplined version has an order, and the order is the subject of the next section.
§ IIIMechanism — Three Disciplines of the Standing Watch
The first discipline is the drawdown circuit breaker. Borrow the name from the electrical part, because the part behaves exactly as the trading control should. A breaker carries current up to a rated limit, trips open past it, and stays open until a human resets it. The trading breaker carries the position up to the session loss ceiling, trips to risk-off past it, and stays tripped until the operator resets it for the next session. The two properties that matter are both in the electrical metaphor. A breaker trips on integrated load, not on a single spike, so the watch trips on sustained drawdown across a short window rather than on one wild print from a single bad tick. And a breaker does not re-close itself, so the watch, once tripped, refuses to re-arm inside the same session, because a control that re-arms after a drawdown invites the strategy to walk straight back into the loss that tripped it.
The second discipline is the staleness watchdog. The watchdog holds a timer per required input and resets that timer on every accepted message. The reset is the message's own arrival, not a periodic poll, so a feed that goes quiet trips the timer by simply failing to reset it. The bound is set per input from its normal cadence with margin: a feed that ticks ten times a second gets a staleness bound of a few hundred milliseconds; an account feed that updates on fills gets a bound measured against the strategy's own order rate, because a fill feed with no fills to report is legitimately quiet and must not false-trip. The watchdog's trip is not the same as the breaker's trip. The breaker trips because the operator is losing too much; the watchdog trips because the operator can no longer tell. Both route to risk-off, and the report names which one fired, because the cure for a breaker trip is a strategy review and the cure for a watchdog trip is an infrastructure repair.
The third discipline is the risk-off cascade, and its order is the whole of its value. Cancel before flatten. The first act of risk-off is to cancel every resting order the book has working, because a resting order is a promise to add exposure the watch is trying to shed, and flattening while orders rest can fill the rested orders into the flatten and leave the book more exposed than when the cascade began. Only after every working order is confirmed cancelled does the cascade send the flattening orders, and it sends them the way the execution lesson taught, sliced against the visible book rather than dumped as one market order into whatever depth happens to be there. The cascade respects the same idempotency keys the executor uses, so a cascade that is itself interrupted and retried does not double-flatten. And the cascade has a floor it will not cross: a position that is already flat is left alone, and a hedge leg the operator marked as protective is excluded from the flatten by name, because flattening a hedge during a risk-off is the failure that turns a controlled exit into an uncontrolled one.
The three disciplines compose into one process that runs beside the strategy, not inside it. The watch reads the same fill log the executor writes and the same mark feed the gate scores against, and it writes one stream of its own: a runtime-event log recording every breaker arm, every watchdog reset-miss, every cascade, with the wall-clock time and the input that fired it. That log is the third report the operator reads at the next open, beside the gate report and the TCA report.
§ IVWorked Example — A Feed Dies Mid-Position
A short-horizon strategy holds a long position opened at the morning's first clean signal, sized at the gate's clipped ceiling after a regime score of zero point six let it through. The session loss budget is forty basis points of capital. The position is up twelve basis points at ten in the morning and the operator is reading email.
At ten-oh-three, the primary market-data feed stops delivering ticks. The socket stays open. A naive monitor, polling the socket's connection state, reports the feed healthy. The mark on the screen freezes at the last good print, and the frozen mark still shows the position up twelve basis points. Nothing on the naive surface looks wrong.
The staleness watchdog holds a bound of three hundred milliseconds on the market-data feed. At ten-oh-three plus three hundred milliseconds, the watchdog's timer for that feed crosses its bound without a reset. The watchdog trips. It does not wait to see whether the feed recovers, because the position is open and the mark is now a lie, and a lie about the mark is worse than no mark. The watchdog routes to risk-off and tags the cause as watchdog: market-data stale.
The risk-off cascade runs in order. It first cancels the two resting take-profit orders the strategy had working above the entry, confirming both cancels against the account feed, which is still live. Only then does it send the flatten, slicing the long position out against the secondary venue's book, because the strategy ran a redundant feed and a redundant venue exactly for this minute, and it reconciles each child fill the way the execution lesson required. The position closes flat at up nine basis points, three basis points of the paper gain paid away to the flatten's slippage and to the spread on the secondary venue.
The primary feed recovers at ten-oh-six. By then the book is flat and the breaker is not even involved; the drawdown ceiling was never approached. The runtime-event log records: one watchdog trip, market-data feed, 10:03:00.31; risk-off cascade complete 10:03:01.20; two resting orders cancelled, one position flattened on secondary venue; realized session PnL plus nine basis points; cause infrastructure not strategy. The next morning the operator reads that log, sees the cause was a dead feed rather than a bad thesis, and routes the work to the feed's owner instead of to the strategy's author. The strategy was right. The infrastructure failed. The watch told the operator which, and it told the operator while the position was still savable.
Compare the counterfactual. Without the watchdog, the frozen mark holds the operator blind. The market moves three percent against the real position during the three blind minutes. The operator returns to email at ten-fifteen, sees a mark that updated to catastrophe when the feed recovered, and flattens in a panic into the worst depth of the move. The same right strategy ends the session down past its budget, and the operator spends the evening debugging the thesis instead of the feed.
§ VConnection to Prior Lessons
This lesson closes the γ-pair daily loop the four prior lessons opened. The 2026-05-22 signal-pipelines lesson named the five upstream stages that produce an intent. The 2026-06-04 pre-trade-gate lesson named the machine that refuses or forwards the intent. The 2026-05-29 execution lesson named what happens when the intent becomes child slices in the market. The 2026-06-02 TCA lesson named the retrospective verdict the operator reads the next morning. Today's runtime watch fills the one gap the four left open: the live interval between the executor's last fill and the next morning's TCA, where the position is alive and unattended and the regime is free to turn. The loop now reads whole — signal, gate, execute, watch, measure — and the watch is the only one of the five that acts on the operator's own book rather than on the market.
The 2026-05-29 execution lesson is the watch's nearest neighbor. The risk-off cascade is an executor invoked under duress, and it reuses the execution lesson's two hard disciplines without modification: slice against visible depth rather than dump, and key every child order with the idempotency token that survives a retry. A cascade that abandoned those disciplines because the situation felt urgent would pay the panic-slippage the cascade exists to prevent. The 2026-06-02 TCA lesson supplies the cascade's grade: a risk-off flatten is measured for implementation shortfall the same way a normal exit is, and a cascade that consistently pays more than its modeled cost is a cascade whose slicing is mistuned.
§ VIConnection to Today's Dev Lesson
The Python lesson today builds the watch's concurrency skeleton. A watch is several timers and several feed-readers running at once, any one of which must be able to trip the whole and bring the others down in order. Python's structured-concurrency tools are the right shape for exactly this. A task group owns the feed-readers and the timers as a set, so that when the watchdog task raises its trip, the group cancels its siblings rather than leaking them. A cancellation scope with a deadline is the watchdog's timer expressed directly: the scope expires, the trip raises, the cascade runs in the scope's cleanup. The Dev lesson works the asyncio task-group pattern, the timeout-as-cancellation idiom, and the discipline of running the risk-off cascade in a shielded block so that the cancellation which triggered it does not also cancel the flatten it must complete.
The two lessons meet at the cascade's most dangerous moment. The Ops side says cancel before flatten and never abandon the flatten partway. The Dev side says the flatten must run under a shield, because a watch built on cancellation will, by its nature, try to cancel the cascade the instant after the cascade starts. An operator who reads only the Ops side ships a cascade that a stray cancellation can interrupt between the cancel and the flatten, leaving resting orders gone but the position still open. An operator who reads only the Dev side ships a perfectly-shielded cascade that flattens the protective hedge. Both disciplines are required, and they are required together.
§ VIIClosing
A strategy without a runtime watch is a strategy that trusts the next two hours to behave like the last backtest. Most two-hour windows behave. The window that does not is the one with the dead feed, the halted venue, or the regime that turned while the operator read email, and that window does not announce itself before it arrives. The watch is the standing guard that assumes the bad window is always one tick away and is ready for it every tick.
Cancel before flatten. Blind means flat. A tripped breaker stays tripped until a human resets it. These three are the whole discipline, and an operator who holds them keeps the worst window from becoming the worst day. The cost is a few flattens that turn out to have been unnecessary. The return is the one flatten a year that was necessary and ran in time.
Examine well. Reflect on this.