Overview
Brokerages sometimes change the internal instructions attached to an order after Toll Booth has already analyzed and submitted it. When that happens, the meaning of the order at the broker can drift away from what Toll Booth believes it is managing.
The safety check built into Toll Booth ensures we either:
- Record the original instructions the first time we see them, or
- Cancel the order if the instructions later change in a way that could be unsafe.
Key ideas
Each order can have two snapshots of its instructions:
- First‑seen instructions – what the broker told us about this order the first time we processed its instructions.
- Current instructions – what the broker is telling us about this order right now.
If these ever disagree, it usually means the broker changed the order behind the scenes — for example, converting a closing order into an opening order or changing how a multi‑leg strategy behaves.
If the instructions changed in a way Toll Booth did not explicitly initiate, we treat the order as unsafe and cancel it.
Which orders are checked?
The safety check looks at all active orders that have not yet been reviewed. For each of these orders it:
- Marks the order as reviewed so we only ever review it once.
- Compares the first version of the broker’s instructions it stored with the latest instructions currently reported by the broker.
If the instructions fully match (including the multi‑leg symbol set), the order is left alone and no cancel is triggered.
Case 1: No change detected
If our internal comparison says the latest instructions still match the first version we saw, we consider the order stable:
- We simply mark the order as reviewed.
- We do not change, cancel, or log anything else for this order.
Case 2: We have current instructions but no original instructions
This is the “first time seen” situation: the broker is sending us a description of how the order should behave, but we have not yet stored an initial copy of those instructions on our side.
2a. System‑created CUSTOM orders (high‑risk path)
If all of the following are true:
- The order is using a custom multi‑leg options strategy type.
- The broker is currently providing a full set of instructions for the order.
- We do not yet have any stored “first version” of those instructions on our side.
- The order was not manually entered by you and was instead created by the automated system.
then we treat this as a potentially unsafe broker‑side change. Instead of saving the broker’s current instructions as the trusted first version, Toll Booth:
- Builds a detailed explanation that includes the order identifier, strategy type, and the before‑and‑after view of the instructions.
- Immediately and forcefully cancels the order, even if it would normally be left open.
- Skips any further handling of this order in this run.
This protects against CUSTOM orders silently morphing into something different than what Toll Booth originally intended to place.
2b. All other orders (normal path)
For every other order where the broker is sending instructions but we have not yet stored a first version on our side:
- We do not cancel the order.
- If the order was created by the system rather than manually entered, we send an internal notification noting that the first‑seen instructions were missing and are now being back‑filled.
- We save the broker’s current instructions as the first‑seen version and store that on the order.
This is a one‑time bootstrap: from that point forward, this order will be eligible for the “changed instructions” cancel logic if the broker ever changes its instructions again.
Case 3: Instructions changed after we seeded them
If both a previously stored first version of the instructions and the broker’s current instructions are present but they do not match (including which option legs are included), we treat this as a true instruction change:
- We build a message showing the before‑and‑after instruction details and which specific option legs and symbols are involved.
- We raise an alert so the change is visible to operators.
- We cancel the order using a forceful path so it is taken off the broker immediately.
The goal is to never leave a live order on the broker that Toll Booth believes is doing one thing while the broker has silently changed its behavior behind the scenes (for example, switching from closing to opening, or changing which legs are included).
Manual orders are treated more cautiously
Manually entered orders are handled more conservatively:
- We avoid automatically cancelling manual orders in the “no stored instructions yet” path; instead we save the broker’s current instructions as the first‑seen version so future changes can still be detected.
- The aggressive rule for custom multi‑leg strategies above applies only to system‑created custom orders; manually entered custom orders are not automatically cancelled by this safety check.
This separation ensures that automated, system‑driven orders are aggressively protected, while respecting the user’s direct manual intent.
Why this safety check matters
Without this safeguard, it is possible for:
- A closing order to mutate into an opening order without Toll Booth noticing.
- A multi‑leg options strategy to change which legs are included, changing the risk profile.
- Broker‑side rewrites of CUSTOM strategies to remain active even though they no longer match Toll Booth’s model of the trade.
By tracking the first‑seen version of each order’s instructions and cancelling orders whose instructions later diverge, this safety check keeps the live order book aligned with what Toll Booth actually understands and intends to manage.