The life of an order
The exact sequence between “trader clicks buy” and “the whole market knows” — the spine every later mechanism depends on.
The three-tier architecture gives commands to a deterministic core and sends facts to asynchronous consumers. We can now follow one command across those boundaries.
A plausible simplification is to treat a gateway response as acceptance, let risk run later, and allow private fills and public prints to be produced by separate database readers. The catch is that failed risk never reaches matching; once the core accepts an order, that commitment survives the client connection, and each fill atomically yields both private and public facts.
Alice submits: buy 100 shares of ACME, limit price 10.00. The book currently has no sellers at 10.00 or better, so her order will rest. Later, Bob's sell arrives and fills it. Follow the numbers in the diagram:
sequenceDiagram
autonumber
participant A as Alice
participant G as Gateway
participant R as Risk
participant M as Matching engine
participant D as Market data
A->>G: buy 100 ACME limit 10.00
G->>G: session valid? symbol known? price on tick?
G->>R: order forwarded
R->>R: reserve 1000.00 of Alice's buying power
R->>M: order accepted into core
M-->>A: ACK — order live, resting on book
M->>D: quote update: bid 10.00 x 100
Note over M: minutes later, Bob sells 100 at 10.00
M-->>A: FILL — 100 at 10.00
M->>D: trade print: 100 at 10.00
D-->>A: everyone sees the new price
Three rules of the road, visible in the diagram:
- Reject early, reject cheap. Syntax and session checks happen at the stateless edge (step 2); a malformed order never costs core capacity. Risk (step 4) is the last gate before the order becomes the market's problem.
- The ACK is a promise. After step 6, Alice's order is part of the market. It will be honored even if Alice disconnects — until she cancels or it expires.
- Private and public messages are two views of one event. The fill Alice receives and the trade print the market receives are generated from the same match, atomically. If they could diverge, arbitrageurs would find the gap within days.
Alice disconnects after the core accepts her order but before she receives the acknowledgment. If acceptance lived in the gateway, another gateway could neither resume nor answer safely. Core-owned commitment lets the session replay the same outcome without inventing a second order.
Validate at the edge, gate at risk, decide at the engine, publish to all. ACKed orders are commitments that outlive the client's connection. Private fills and public prints are one atomic event, split into two audiences.