Reconciliation and Recovery
After failure, local intent, durable records, venue state, and downstream positions may disagree. Recovery begins by discovering authoritative external state.
Central questions
- Which records survive each failure boundary?
- Which resend or cancel actions are idempotent?
- When must automated recovery stop for operator judgment?
Planned model
Crash a gateway at several acknowledgement boundaries and reconcile local logs with venue order and trade reports before allowing new activity.