Hysteresis Market State Machine

01Executive Summary

JIL Sovereign's DEX v5 trading system operates under a four-state market machine (NORMAL, ELEVATED, STRESSED, HALTED) that uses hysteresis thresholds to prevent oscillation between states. Entry thresholds are strictly higher than exit thresholds for each signal, meaning the market must improve significantly beyond the trigger point before the system steps down to a less restrictive state.

The state machine evaluates multiple independent signals - volatility, oracle deviation, utilization, and settlement failure rate - each with its own hysteresis band. Transitions upward (toward more restrictive states) can skip levels for rapid escalation, while transitions downward must step one level at a time with enforced dwell times, ensuring that markets stabilize fully before restrictions are relaxed.

02Problem Statement

Traditional circuit breakers use symmetric thresholds: a market halts at a certain level and resumes when conditions return to the same level. This creates oscillation where the market repeatedly crosses the threshold, triggering rapid halt-resume-halt cycles that amplify the very volatility they are designed to contain.

2.1 Circuit Breaker Failures in Practice

• Flash Crash Oscillation: During the 2010 Flash Crash, circuit breakers triggered and released repeatedly within minutes, creating additional uncertainty and accelerating the sell-off rather than containing it.
• Restart Stampede: When a halted market resumes, pent-up orders flood the book simultaneously, often causing an immediate re-halt and eroding confidence in the system.
• Single-Signal Blindness: Most circuit breakers monitor only price movement. A market may be under stress from multiple dimensions (liquidity withdrawal, settlement failures, oracle divergence) without triggering a price-based circuit breaker.

2.2 Why Existing Approaches Fail

03Technical Architecture

The state machine maintains a singleton state record with the current market state, the timestamp of the last transition, and the dwell time remaining before a downward transition is permitted. Four independent signal evaluators feed into the transition logic.

3.1 State Definitions

3.2 Hysteresis Thresholds

3.3 Asymmetric Transition Rules

The state machine enforces two asymmetry rules. First, upward transitions can skip levels - a sudden spike in volatility from 200 bps to 1200 bps can move the market directly from NORMAL to STRESSED, bypassing ELEVATED entirely. Second, downward transitions must step exactly one level at a time, and each level requires the dwell time to elapse before the next downward step. This means recovering from HALTED to NORMAL requires a minimum of 45 minutes (30 + 10 + 5) even if all signals return to normal immediately.

04Implementation

4.1 Signal Evaluation Pipeline

1. Signal ingestion: The market-state service receives price updates, oracle feeds, utilization metrics, and settlement status on a continuous basis via internal HTTP endpoints.
2. Threshold evaluation: Each signal is independently compared against its entry and exit thresholds for all applicable states. The evaluation uses the current state to determine which thresholds are relevant.
3. Escalation check: If any signal exceeds an entry threshold for a state above the current state, an escalation is triggered. The system moves to the highest triggered state (skip-up behavior).
4. De-escalation check: If all signals are below the exit thresholds for the current state AND the dwell time has elapsed, the system steps down exactly one level.
5. State persistence: The new state, transition timestamp, and triggering signals are recorded in the market_state_current singleton and the market_state_transitions history table.

4.2 Governance Override

Multi-signature governance can force a HALT or resume the market regardless of signal levels. A governance HALT overrides all autonomous transitions and requires a governance RESUME to exit. The governance override is logged with the authorizing signatures and reason, creating an immutable record of manual intervention.

4.3 Dwell Time Enforcement

Dwell times are enforced at the database level using the transition timestamp. When the system evaluates a potential de-escalation, it computes now - last_transition_at and compares against the current state's dwell time. No de-escalation occurs until the dwell time has fully elapsed, even if all signals have returned to normal.

05Integration with JIL Ecosystem

5.1 Execution Router

The execution router queries the market state before processing every trade intent. In HALTED state, all intents are rejected. In STRESSED state, intents are routed preferentially to the RFQ lane. In ELEVATED state, spreads are widened and batch caps are reduced. The router fetches state via HTTP with a 2-second timeout and fails open to NORMAL, ensuring that a market-state service outage does not halt trading.

5.2 Retail Lane Engine

The batch auction engine adjusts its clearing parameters based on the current market state. In ELEVATED state, batch windows are extended and maximum batch sizes are reduced. In STRESSED state, the engine processes smaller batches with wider oracle bands to accommodate higher volatility.

5.3 Risk Engine Integration

The market state feeds into the broader risk engine for portfolio-level risk calculations. An ELEVATED or STRESSED state triggers enhanced margin requirements for leveraged positions and tighter position limits for new orders.

5.4 Settlement Consumer

During HALTED state, the settlement consumer continues processing existing settlement messages but no new trade settlements are generated. This ensures that in-flight trades complete while preventing new exposure from accumulating during the halt.

06Prior Art Differentiation

07Implementation Roadmap

08Patent Claim