ORDER FLOW AND MARKET STATES

Whether the engine accepts your order is the product of two checks: the signed payload itself must be valid, and the current market posture must permit the action you are requesting. The first is covered on the admission page; the table below summarizes the second. Each posture is an explicit admission rule — the engine rejects forbidden actions at the gate rather than letting them sit and silently fail.

#Admission before matching

Before pricing logic runs, the engine classifies each request along three axes: does the target market exist and pass its freshness check, is the signed payload inside its validity window, and would the fill increase or reduce the account's directional risk. The add-vs-reduce distinction is what lets a market accept close orders while rejecting opens — close-only and reduced postures both depend on that classification rather than on a UI hint.

Production runs IOC-only. The gateway enforces GATEWAY_REQUIRE_IOC, so every signed order is evaluated against live state at arrival and any unfilled remainder is cancelled in the same transition. There is no working order book sitting between the trader and the engine, which means a posture transition takes effect on the next arriving order rather than retroactively touching resting size. That keeps stress behavior narrow and reproducible: every fill is a single signed payload meeting a single state snapshot.

#State machine instead of hidden restrictions

Markets do not move from live to failure in one step. The intermediate postures — reduced, close-only, session-closed — exist so the venue can tighten without going opaque. A reduced market is still functional but more expensive on new size. A close-only market lets you exit but blocks fresh exposure. A session-closed market is honoring an underlying calendar (NYSE hours, LBMA fix windows, energy benchmarks) instead of pretending a stale tick is still a valid reference.

Halted is materially more serious: an oracle path has broken, a stress event is being reviewed, or operator intervention is required to restart the venue. The posture is always visible in the trade UI before you submit, and the engine rejects forbidden actions at admission rather than letting them sit in a queue. A trader should never have to infer market state from price action alone — the posture is published, the rule is enforced at the gate, and the rejection reason is returned synchronously.

signed IOC arrives
  -> signature, seq, createdAtTs, goodTilTs validity
  -> market freshness and posture check
  -> add-risk or reduce-risk classification
  -> posture rule: admit or reject
  -> vAMM quote against skew / inventory cap
  -> fill or cancel remainder in same transition

#What each posture means for an attempt

• Live. The default posture during major crypto sessions. Open, close, scale in, scale out at the standard 0.020% maker / 0.060% taker schedule. Skew-adjusted taker pressure is at its baseline floor.
• Reduced. The most common "stress but functional" state. Fresh size is admitted, but the inventory cap is tighter, the skew-adjusted taker rate is higher, and the per-account directional notional limit moves down. Existing positions continue to mark, accrue funding, and bind to the maintenance margin floor — only new opens are throttled.
• Close-only. Reduction is open, opens are blocked. A long can sell to flat or smaller, but cannot scale up. A flat account cannot enter. Stop-loss and take-profit reductions still route. New same-side adds are rejected at admission with an explicit reason, not queued.
• Session-closed. The venue is honoring the underlying market's calendar — NYSE bell hours for equity perps, LBMA windows for metal perps, exchange hours for energy perps. Positions are held, but marking against a stale tick is suspended. Drawdown rule checks pause until the next session opens.
• Halted. No new execution, including reduction. Typically triggered by an oracle path break, a stress event, or an operator review. While halted, equity does not advance, fundingAccrued does not progress, and the 30-day evaluation window pauses. The clock resumes only when the engine restores a normal posture and the next signed order is admitted.

Posture changes are admission rules, not UI overlays. The current state is published before you sign — if you submit an open into a close-only market, the engine returns the rejection synchronously rather than sitting on the order. Inside a 30-day challenge window, a session-closed or halted period extends your deadline by the paused duration; a reduced or close-only period does not, because the engine is still admitting valid risk-reducing flow against your equity.