# TODO

Last updated: 2026-03-20

This file tracks actionable engineering follow-ups.

## Open

### [P1] Enforce cross-match aggregate exposure circuit breaker

Status: Not started

Context:

- `CrossMatchConfig.risk.max_total_exposure` is configurable.
- `CrossMatchEngine::attempt_cross_match` still has a TODO and does not enforce it.
- Current location:
  - `src/cross_match/mod.rs`

Why it matters:

- Without enforcement, configured global risk limits are informational only.
- Tolerance-based matching can accumulate exposure across unsettled markets.

Proposed direction:

1. Track aggregate outstanding cross-match exposure in a durable/recoverable structure.
2. Reject new attempts when `current_exposure + worst_case_loss > max_total_exposure`.
3. Decrease exposure on settlement/void paths deterministically.

Acceptance criteria:

- Circuit breaker is enforced in `attempt_cross_match`.
- Exposure state survives restart/recovery.
- Add regression tests for reject-at-limit and release-after-settlement flows.
