Writing on trading-systems engineering

The one property that governs every trading system: whether it holds when capital is at stake and load is high. The failures that destroy the most value are silent, not loud.

One validation engine serves research and production, so a backtest and a live decision can never quietly disagree.

A pre-trade control that cannot answer inside the latency budget is, in production, the same as no control at all.

Give each piece of mutable state exactly one writer, and latency stops depending on who else is contending for it.

Past its freshness deadline a value is absent, not trustworthy, and treating stale as fresh is how silent losses begin.

An idempotency key makes a retried order place exactly once and never twice, however the network misbehaves.

One authoritative pre-trade gate beats two that can drift apart and disagree at the worst possible moment.

When the pre-trade path cannot verify, it must reject rather than pass, because unevaluated is not the same as allowed.