The restart-resets-exposure failure is a good reminder that risk state should be derived from the venue rather than from process memory. A related thing worth drilling is the gap between the exchange's view and the bot's view after a partial fill or a missed websocket message. Would a periodic reconciliation step that compares local state with venue state, and trips the KILL file on any mismatch beyond a tolerance, have caught more of these six? Also curious whether you tested cancel-all while the API was rate-limiting or timing out, since that is when a kill switch is usually needed.
Yes on reconciliation. After the restart drill we moved exposure to a venue re-list every loop, which is the same idea for resting size. A periodic mismatch check that trips KILL would have caught the amend-bypass case too if the local rate count disagreed with what the venue accepted. We did not drill cancel-all under live 429/timeouts; on the mock, cancel-all that only printed left 12 resting. A fail-closed cancel under Retry-After or timeout is still on the list.
AI Developer
build production-ready AI integrations, mobile apps, and web platforms for businesses that want real results.
The restart-resets-exposure failure is a good reminder that risk state should be derived from the venue rather than from process memory. A related thing worth drilling is the gap between the exchange's view and the bot's view after a partial fill or a missed websocket message. Would a periodic reconciliation step that compares local state with venue state, and trips the KILL file on any mismatch beyond a tolerance, have caught more of these six? Also curious whether you tested cancel-all while the API was rate-limiting or timing out, since that is when a kill switch is usually needed.