The restart-resets-exposure failure is a good reminder that risk state should be derived from the venue rather than from process memory. A related thing worth drilling is the gap between the exchange's view and the bot's view after a partial fill or a missed websocket message. Would a periodic reconciliation step that compares local state with venue state, and trips the KILL file on any mismatch beyond a tolerance, have caught more of these six? Also curious whether you tested cancel-all while the API was rate-limiting or timing out, since that is when a kill switch is usually needed.