§ SYSTEM DESIGN / Design edition 0.1

ANTHERA
DATA PLANE

Market data as an owned system.
One trace. One truth. Bounded at every edge.

Fig. A — The stable reading trace. Runtime topology and narrative order are related, not identical.

MISE› mise x -- task verify↗ BUILD BOOK

[SYSTEM THESIS]

Market data as one continuous trace

Selection, authorization, live delivery, historical recovery, and chart paint belong to one product boundary. Every handoff carries identity, ordering, provenance, and a recovery instruction.

TRACE-AS-PRODUCT

One contract from demand to paint.

The browser asks an authenticated gateway for an owned series. The data plane answers with a stable snapshot, a typed live tail, and an opaque path into older committed history.

HOW IT READSExisting data paints first. Live ownership attaches without a gap. Missing history fills in bounded, coalesced ranges. The chart appends, replaces, or prepends.

contracts/series.rspub struct SeriesQuery {
  identity: SeriesIdentity,
  before: Option<Cursor>,
  limit: PageLimit,
  generation: Generation,
}

pub enum StreamFrame {
  Snapshot(Page),
  Update(Bar),
  Resync(ResyncReason),
}

OWNED BOUNDARIES

Domain meaning stays owned.

Provider, database, cache, broker, and workflow types terminate at adapters. Stable Anthera contracts carry identity, time, provenance, entitlement, and recovery semantics inward.

INWARD RULEContracts describe wire shapes. Domain types enforce invariants. Application services coordinate ports. Runtime and CLI compose adapters without becoming the domain.

domain/series.rspub struct SeriesIdentity {
  source: SourceId,
  instrument: InstrumentId,
  schema: SchemaVersion,
  generation: Generation,
}

pub trait HistoricalProvider {
  async fn fetch(&self, query: RangeQuery)
    -> Result<Page, ProviderError>;
}

SHARED LIVE PATH

One source serves many viewers.

A fenced owner records each normalized source event once, advances durable state once, and fans the same ordered envelope to every authorized viewer through bounded queues.

GAP-FREE ATTACHAuthorize, read a stable snapshot, attach to the owner, replay the suffix after the watermark, then enter the live tail. A missing suffix becomes an explicit resync.

application/live.rspub enum LiveAttach {
  Snapshot { page: Page, watermark: Watermark },
  Replay { after: Sequence },
  Tail { owner: FencingToken },
  Resync { reason: ResyncReason },
}

pub const VIEWER_QUEUE: usize = 256;

INFINITE HISTORY

History grows left without blocking live.

A cold ticker paints committed data immediately, attaches the live tail, and starts one bounded range workflow for missing coverage. Overlapping viewers join the same work.

RANGE CONTRACTOpaque cursors bind series identity, generation, and committed watermark. Coverage advances only after QuestDB acknowledges the batch; cancellation follows visible-range demand.

application/backfill.rspub struct BackfillKey {
  series: SeriesIdentity,
  range: TimeRange,
  generation: Generation,
}

pub enum CoverageState {
  Missing,
  Filling(WorkflowId),
  Committed(Watermark),
}

TYPED RECOVERY

Failure is an owned state transition.

Provider limits, commit lag, cache loss, owner expiry, and viewer pressure each have a bounded consequence, a visible watermark, and one deterministic recovery command.

OPERATING RULENo queue grows without a limit. No stale owner publishes after fencing changes. No cache becomes authority. No viewer receives an untyped gap.

domain/failure.rspub enum DataPlaneFailure {
  ProviderBudget { retry_at: Timestamp },
  CommitLag { durable: Watermark },
  ReplayLost { resync_from: Cursor },
  OwnerFenced { token: FencingToken },
  SlowViewer { policy: ShedPolicy },
}

[SHARED OWNERSHIP]

One kernel, many viewers

One Nautilus flow feeds durable projections and many viewers.

Fig. A — The stable reading trace. Runtime topology and narrative order are related, not identical.

Fig. 01 DBN becomes Nautilus state, history, and chart state.

01DECODE

Map DBN once into Nautilus values.

one market model

02PROCESS

One kernel runs data, cache, bus, and strategies.

backtest / live parity

03COMMIT

Advance coverage after QuestDB commits.

watermark

04SERVE

Authorize history/live; gaps are typed.

bounded + explicit

✓ kernel + history/live joinedseries + generation attributed

Cache DB, event store, QuestDB, and service Redis remain distinct. The browser uses the gateway.

→ OPEN THE LIVE-PATH CONTRACT ↗

[CAPABILITIES]

The system, by boundary

03Owned boundaries

Nautilus owns market and trading meaning; Anthera owns service metadata, durable projections, and browser contracts.

04Identity and time

A record is not identified by timestamp alone; source, series, generation, correction lineage, and durability travel with it.

05The live path

One upstream subscription serves many viewers through fenced ownership, bounded fanout, and typed recovery.

06Cold ticker and infinite history

A cold selection becomes useful immediately while one durable, coalesced workflow fills missing history behind an opaque cursor.

07Storage and coordination

The Cache database, event store, QuestDB catalog, Redis projections, and cold files each have one explicit authority.

08Framework and Nautilus decisions

Leverage means adopting the coherent Nautilus kernel, then owning only the distributed service gaps it leaves open.

[BOOK MAP]