Writing a trading system that works when data flows and the broker responds is the easy 80%. The hard, essential 20% is what happens when it doesn't — the feed drops, a quote goes stale, the broker API times out, the connection stutters. Resilience is what separates a demo from a system you'd let manage real orders.

Fail safe, not silent

The cardinal rule: when in doubt, do nothing dangerous. A stale quote must not trigger a trade priced off old data. A timed-out order status must be re-checked, not assumed. A dropped feed should pause new entries, not fire blind. The worst failure isn't stopping — it's acting confidently on bad information.

The specific hazards

Consider the traps: a network stutter mid-order (did it go through? retrying could double it — so writes aren't blindly retried); a partial fill that must be reconciled to the real position; a rate limit that must be backed off, not hammered. Each is a place where a naive loop corrupts its own state or duplicates an order. Handling them is unglamorous and non-negotiable.

A trading system isn't judged on the day everything works. It's judged on the day the feed dies mid-position.

Why it matters

Markets are messy and infrastructure fails at the worst moments. A system built to fail safe — pausing on stale data, reconciling true fills, never double-submitting, recovering cleanly on restart — is one you can actually trust. That defensive engineering is the boring backbone of NoVo's execution: it protects the account precisely when the plumbing gets ugly.