Fail closed
If required information or runtime state is uncertain, new execution is blocked.
SAFETY
Execution stops when the system cannot prove safety.
The runtime prefers blocking an uncertain action over guessing.
Crash recovery
Runtime state, checkpoints and event journal can recover and reconcile after restart.
No duplicate execution
Duplicate bars and replayed market inputs do not advance the same sequence twice.