Controls and Failure Modes
Quoting must remain bounded when data is stale, connectivity fails, volatility jumps, inventory grows, or acknowledgements become uncertain.
Central questions
- Which conditions withdraw one side or all quotes?
- What state is trustworthy during a disconnect?
- How are message rate, exposure, and loss bounded independently?
Planned model
Inject stale feeds, reject storms, cancel delays, volatility shocks, and position-limit breaches into a quoting state machine and observe its safe-state transitions.