Auctions, halts, and safeguards

Continuous price-time matching assumes a steady stream of orders on both sides. At the open, after news, or in a panic, that assumption fails — and matching the first stray order at an absurd price would set an absurd price for the whole market. Exchanges therefore run each symbol through trading phases:

stateDiagram-v2
    [*] --> PreOpen: orders accepted, no matching
    PreOpen --> OpeningAuction: market open time
    OpeningAuction --> Continuous: uncross at the equilibrium price
    Continuous --> Halted: circuit breaker or news halt
    Halted --> ReopenAuction: cooldown elapsed
    ReopenAuction --> Continuous: uncross
    Continuous --> ClosingAuction: end of day approaches
    ClosingAuction --> Closed: uncross sets official close
    Closed --> [*]
    

How an auction works: during the call phase, orders accumulate without matching — the book is allowed to cross. At the uncross, the engine computes the single price that maximizes executable volume, executes all crossing orders at that one price, and only then switches to continuous mode. The opening price is thus a consensus of everyone's overnight interest, not a race.

Safeguards during continuous trading:

• Price bands (limit-up / limit-down): orders that would trade more than, say, 5% away from a rolling reference price are rejected or the symbol is paused. This is the fat-finger backstop.
• Volatility circuit breakers: if the price moves beyond a threshold within a window, the symbol transitions to Halted, then re-enters via auction. Market-wide breakers do the same for everything at once.
• Message throttles: per-participant caps on orders per second — protecting the venue from runaway algorithms (and lesson 2.7 will generalize this into overload defense).

Note the design economy: halts, auctions, and continuous trading are all just modes of the same engine over the same book — an auction is matching with the uncross deferred. The phase machine slots into the engine's event stream like any other input (a timer event triggers the uncross), which means Part 2's replication story will cover it with no extra work.