Reference

Exchange State

Treat Account State as the local truth store, but split trust by subject. A fresh order event does not automatically prove position state is ready for dependent planning.

Core Model

Account State is the local view of exchange state. Trusted State is evaluated per subject, not once for the whole account.

Keep Order Trust, Position Trust, Asset Trust, filters, and context as separate trust subjects.
Position covers the native position versus locally derived Spot position distinction.
The Runtime Workflows page covers startup hydration, reconnect repair, event bursts, and scoped recovery boundaries.
For implementation order, artifacts, and conformance checks, use Exchange State Management.

Planning Rule

Plan only from the subjects required by the next action. Request acceptance and order events can trigger work, but they do not automatically prove every dependent subject is current.

Order Trust does not imply Position Trust.
Pending Confirmation waits for Private Stream Confirmation or Scoped Recovery evidence before dependent work continues.
Asset Trust is balance evidence and reconciliation input; it is not a replacement term for managed position state.

Ownership Rule

Fresh state and mutation authority are separate questions. The system must know both what the exchange state is and which orders it owns.

Durable Context stores local order meaning before submission.
Custom Order IDs are lookup keys into durable local order context, not state containers.
App-owned orders can be mutated only when ownership and context are known, or when explicit adoption is configured and tested.