Matching engine - price-time priority, and why the clock cannot decide who was first

An exchange is a fairness machine. Its product is not throughput and not latency - it is the credible claim that the same rules were applied to everybody in the same order, and that the order can be proved afterwards.

Ask these before designing

• Continuous trading, or auctions? Continuous matching is the interesting engine. Opening and closing auctions are a different algorithm - collect, then cross at one price - and most real venues need both, which means two matching modes over one book.
• Which order types? Limit and market is a weekend project. Add stop, iceberg, pegged, and self-trade prevention and the state machine triples. Each new type must preserve determinism, which is why order types are added at roughly one per year and not one per sprint.
• Is there a maker-taker fee? Fees change behaviour, and behaviour changes load. A rebate for resting orders produces a market where 70-80% of messages are cancels, which is a capacity requirement disguised as a pricing decision.
• Who may be first? Strict price-time is one answer. Pro-rata allocation is another, and size-priority is a third. This is a market-structure decision that determines the core data structure, so it cannot be deferred.
• What happens on a halt? Not an edge case: circuit breakers fire on ordinary days. Does the book persist across the halt, or is it purged? Both are defensible, and only one can be true.

Functional

• Accept, amend and cancel orders; every message acknowledged with its sequence number.
• Match strictly by price, then by sequence, and never by timestamp.
• Publish every book change to market data, in sequence, to everybody at once.
• Publish executions privately to the two participants involved.
• Replay any session from the journal and reproduce the same trades, exactly.
• Halt and resume an instrument without losing the book.

Non-functional

• Determinism above everything. Same input sequence, same output, every time, on any machine. Without this there is no standby, no replay, no surveillance and no defence in a dispute.
• p99 tick-to-trade under 20 microseconds inside the engine; p99 gateway-to-ack under 250 microseconds.
• Fairness is measured, not asserted. The spread between the fastest and slowest gateway is published; if one path is reliably quicker, participants pay for it and the venue has an integrity problem.
• No message loss, ever. The journal is written before the engine sees the message, and an unjournalled message does not exist.
• Seven years of replayable history, because that is what a regulator asks for and the unit of the request is "the whole session".

Explicitly out of scope

Clearing and settlement (drawn, not designed), market surveillance algorithms, colocation and the physical network, listing and corporate actions, fee schedules. This board is about the moment two orders meet.