Once more than two services call LLM providers, each one reinvents timeouts, retries and key handling, usually badly. This guide covers what a small internal LLM gateway should do, the timeout and retry rules that work, and how to fail over without making outages worse.
Most trading bot failures we have seen are not strategy bugs; they are state bugs: lost fills, duplicate orders, wrong positions after a restart. This guide describes an architecture that keeps state correct: separated components, an order state machine, persistence, risk checks and reconciliation.
An email provider outage stopped customers from placing orders. Nothing about orders needed email. We rebuilt the service around three ideas: static stability, cell-based isolation and a blast-radius budget per dependency. Here is the worked design.