THE HARD PART
What could not be hand-waved
Partial fills and rate limits. A GTC entry that fills halfway leaves a position nobody planned; the naive fix — waiting for the TTL — leaves risk uncovered. Reconnects are the other one: a WebSocket drop must not produce duplicate orders.
THE RESPONSE
How the risk was addressed
Explicit order state machine. A partially filled entry cancels its remainder immediately instead of waiting out the TTL, and the filled part is either closed at market or bracketed, by configuration. On reconnect the bot recovers sequence and reconciles against the exchange before it is allowed to send anything.