Testing and Releasing Trading Changes

Question 1

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. Which input preserves burst shape?

Accepted Answer

Wire intervals.

Question 2

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. What does constant-rate replay hide?

Accepted Answer

Short periods of excess arrivals.

Question 3

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. Which clock should drive deterministic replay?

Accepted Answer

An injected event clock.

Question 4

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. What must a replay check before comparing latency?

Accepted Answer

Pacing accuracy at the intended load.

Question 5

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. How should a delay introduced by replay infrastructure be treated?

Accepted Answer

Measure separately.

Question 6

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. How could you test results for several burst sizes?

Accepted Answer

Replay documented load variants.

Question 7

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. What proves the 2 ms objective held in the tested run?

Accepted Answer

Queue-age measurements using its defined statistic.

Question 8

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. What about upstream pauses in the recording?

Accepted Answer

Preserve them if relevant to state.

Question 9

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. What if the recorded feed is incomplete?

Accepted Answer

Flag coverage and obtain reliable fixtures.

Question 10

A simulated router sees normal traffic at 4,000 messages per second and bursts at 10,000. One recording preserves wire intervals, while another batches every second. Production has a 2 ms queue-age objective. Why retain a replay seed?

Accepted Answer

Reproduce scheduling choices.

Question 11

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What is the primary safety boundary?

Accepted Answer

The candidate cannot transmit.

Question 12

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. Can the candidate's hypothetical orders count as executed?

Accepted Answer

No.

Question 13

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What comparator should match before judging differences?

Accepted Answer

Common inputs and decision time.

Question 14

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. Why limit shadow CPU usage?

Accepted Answer

It can contend with live routing resources.

Question 15

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What if mirror lag rises above the comparison threshold?

Accepted Answer

Mark observations inconclusive.

Question 16

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What should logs distinguish about order IDs?

Accepted Answer

Simulated IDs versus actual venue orders.

Question 17

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. Which finding can shadow mode establish directly?

Accepted Answer

Whether route decisions differ.

Question 18

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What complementary test estimates candidate fill effects?

Accepted Answer

A bounded authorized live pilot.

Question 19

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What if the candidate sends any message to a live trading path?

Accepted Answer

Stop and investigate isolation.

Question 20

A candidate computes routes in shadow while the incumbent alone sends orders. The candidate sees mirrored inputs and records hypothetical decisions. It has no production writer credentials. What should a useful shadow report include?

Accepted Answer

Coverage, disagreements, and their causes.

Question 21

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. What reject rate is observed?

Accepted Answer

0.6%

Question 22

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. How many rejects would exactly meet the cap?

Accepted Answer

10

Question 23

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. Which latency gate result applies?

Accepted Answer

It passes.

Question 24

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. Can the canary ramp now?

Accepted Answer

No. Rejects fail.

Question 25

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. By how many rejects is the observed count over the cap?

Accepted Answer

2

Question 26

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. What breakdown helps diagnose the rejects?

Accepted Answer

Reason, route, order type, and version.

Question 27

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. How should a state mismatch be handled even if reject data improve?

Accepted Answer

Treat it as an independent stop condition.

Question 28

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. What metric is missing if only completed acknowledgments are timed?

Accepted Answer

Age of outstanding orders.

Question 29

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. What would ensure an equivalent comparison with control?

Accepted Answer

Match the eligibility and reject definitions.

Question 30

A canary handles 2,000 orders. It has 12 rejects against a 0.5% maximum, p99 3 ms against 4 ms maximum, and zero unexplained state differences. All gates must hold. Why set the thresholds before testing?

Accepted Answer

To prevent moving the goalposts.

Question 31

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. Do the ledgers agree just because each totals 100?

Accepted Answer

No.

Question 32

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. How many fewer fills are recorded locally?

Accepted Answer

2

Question 33

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. What should be joined to identify the wrong records?

Accepted Answer

Scoped order and execution identifiers.

Question 34

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. Can the two count differences alone prove exactly two records are wrong?

Accepted Answer

No, other misclassifications may offset.

Question 35

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. What should be checked about any fill appearing twice?

Accepted Answer

Whether both reports share an execution identity.

Question 36

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. What if a late correction changes quantity?

Accepted Answer

Apply it under correction rules.

Question 37

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. What should a side-effect check inspect?

Accepted Answer

Positions and risk reservations.

Question 38

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. Why include a cancel race in replay?

Accepted Answer

A fill can precede cancel completion.

Question 39

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. When should rollout resume?

Accepted Answer

After correction and verified reconciliation.

Question 40

A test sends 100 orders. Venue records show 60 fills, 30 cancels, and 10 rejects, each exclusive. The candidate's ledger shows 58 fills, 32 cancels, and 10 rejects. An independent execution feed is authoritative for fills. What evidence should the failure retain?

Accepted Answer

Events and expected state by order.

Question 41

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. Can a simple binary rollback read V2 safely?

Accepted Answer

No.

Question 42

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What first protects against duplicate transmissions?

Accepted Answer

Fence the active writer.

Question 43

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. Why preserve the original journal before conversion?

Accepted Answer

For recovery and audit.

Question 44

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What should conversion tests include?

Accepted Answer

Mixed records, interrupted migration, and idempotent retry.

Question 45

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. Why verify venue state after conversion?

Accepted Answer

Local state can still be incomplete.

Question 46

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What if the old application cannot enforce a newly required limit?

Accepted Answer

Keep affected trading paused or use an approved alternative.

Question 47

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. How can backward compatibility lower rollout risk?

Accepted Answer

Keep a tested downgrade-compatible format.

Question 48

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What gate precedes normal flow after rollback?

Accepted Answer

Reconcile and run a bounded test.

Question 49

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What indicates the rollback was effective?

Accepted Answer

Measured metrics recover without state divergence.

Question 50

An update writes journal schema V2. The prior binary reads only V1. The rollout allows an approved conversion path after fencing writers and reconciling externally visible orders. What should the team document before release?

Accepted Answer

Triggers, responsible owner, and state recovery steps.

Question 51

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. How does median latency change?

Accepted Answer

Improves by 0.2 ms.

Question 52

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. How does p99 change?

Accepted Answer

Worsens by 4 ms.

Question 53

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. By how much does candidate p99 miss the gate?

Accepted Answer

1 ms

Question 54

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. What must be added for missing acknowledgment risk?

Accepted Answer

Outstanding age and timeout counts.

Question 55

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. Which diagnostic helps locate the regression?

Accepted Answer

Stage timing under matched load.

Question 56

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. What if latency rises only at peak traffic?

Accepted Answer

Test the peak and ramp thresholds.

Question 57

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. Why report tail sample counts?

Accepted Answer

Few tail observations increase uncertainty.

Question 58

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. What if control and candidate traffic differ in order size?

Accepted Answer

Match meaningful order cohorts.

Question 59

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. Which response fits a breached hard gate?

Accepted Answer

Stop expanding and use the approved fallback.

Question 60

The launch gate uses p99 acknowledgment no greater than 8 ms. A matched baseline has p50 1 ms and p99 5 ms. Candidate p50 is 0.8 ms and p99 is 9 ms. Both samples include only completed acknowledgments. What should recovery verification include?

Accepted Answer

The affected tail, outstanding orders, and state.

Question 61

A new application decodes both old and new reports. A venue simulator can send duplicates, delayed corrections, and messages with omitted optional fields. A separate venue test verifies actual session behavior. What test checks an omitted optional field?

Accepted Answer

Decode without changing unrelated state.

Question 62

A new application decodes both old and new reports. A venue simulator can send duplicates, delayed corrections, and messages with omitted optional fields. A separate venue test verifies actual session behavior. How should delayed corrections be verified?

Accepted Answer

Apply the correction once to the intended execution.

Question 63

A new application decodes both old and new reports. A venue simulator can send duplicates, delayed corrections, and messages with omitted optional fields. A separate venue test verifies actual session behavior. What identifies duplicate business events?

Accepted Answer

The documented execution identity and scope.

Question 64

A new application decodes both old and new reports. A venue simulator can send duplicates, delayed corrections, and messages with omitted optional fields. A separate venue test verifies actual session behavior. Why test actual sessions in addition to simulation?

Accepted Answer

Simulator assumptions may differ from venue behavior.

Testing and Releasing Trading Changes

Replay fidelity

Shadow isolation

Gate arithmetic

Reconciliation at restart

Rollback safety

Latency distribution

Protocol compatibility

Risk invariants

Capacity ramp

Release sign-off