A commit/rollback pair returned from a custom policy decision.
Apply tentative state before registering the pair. For an ordinary
reservation, the engine calls commit() after the venue acknowledges the
order, or rollback() otherwise. A drop-copy operation registers the same
pair and finalizes it the same way, from commit() or rollback() on the
DropCopyOperation. A rollback also runs for mutations whose commit was
never reached, because their tentative state was already applied.
A policy may register this pair by returning it from performPreTradeCheck,
or from checkPreTradeStart through
ctx.recordDropCopyStartMutation(mutation) for drop-copy-only start work.
Neither callback has the right to fail. By the time a finalizer runs the
decision is already made and the state it finalizes was applied eagerly, so
there is nothing left to compensate. A callback that throws anyway is
reported on two independent channels. The throw itself reaches whoever called
commit() / rollback(), wrapped in a PolicyCallbackError, once every
remaining callback of the batch has run - a failing callback never stops the
batch. Separately, the engine arms its kill switch, because its own
bookkeeping is now in an unknown state. Every mutation registered from
JavaScript belongs to a custom policy, whose state reach the engine cannot
bound, so that kill switch blocks every account, not only the order's
own. Nothing reports the block to the finalizing caller: it surfaces when the
next pre-trade call is rejected with SystemUnavailable. An operator clears
it with engine.accounts().unblockAll().
Both callbacks receive this instance as this; see MutationFn for
what that binding does and does not promise. There is no wasm class for it
because it carries JS closures the engine invokes.
A commit/rollback pair returned from a custom policy decision.
Apply tentative state before registering the pair. For an ordinary reservation, the engine calls
commit()after the venue acknowledges the order, orrollback()otherwise. A drop-copy operation registers the same pair and finalizes it the same way, fromcommit()orrollback()on theDropCopyOperation. A rollback also runs for mutations whose commit was never reached, because their tentative state was already applied.A policy may register this pair by returning it from
performPreTradeCheck, or fromcheckPreTradeStartthroughctx.recordDropCopyStartMutation(mutation)for drop-copy-only start work.Neither callback has the right to fail. By the time a finalizer runs the decision is already made and the state it finalizes was applied eagerly, so there is nothing left to compensate. A callback that throws anyway is reported on two independent channels. The throw itself reaches whoever called
commit()/rollback(), wrapped in aPolicyCallbackError, once every remaining callback of the batch has run - a failing callback never stops the batch. Separately, the engine arms its kill switch, because its own bookkeeping is now in an unknown state. Every mutation registered from JavaScript belongs to a custom policy, whose state reach the engine cannot bound, so that kill switch blocks every account, not only the order's own. Nothing reports the block to the finalizing caller: it surfaces when the next pre-trade call is rejected withSystemUnavailable. An operator clears it withengine.accounts().unblockAll().Both callbacks receive this instance as
this; see MutationFn for what that binding does and does not promise. There is no wasm class for it because it carries JS closures the engine invokes.