بحث موثق بالمصادر: OKX

Verified source facts

1. OKX's production checksum deprecation took effect on June 23, 2026 for books, books-l2-tbt and books50-l2-tbt JSON WebSocket channels. 2. The checksum field remains in affected messages but is fixed to zero and is no longer an integrity signal. 3. OKX instructs clients to use seqId and prevSeqId for continuity and accuracy checks. 4. Kraken's futures book feed also exposes a sequence number on snapshots and deltas, illustrating that ordered state application is a separate control from transport encryption.

Comparison at a glance

1. Control test: Channel inventory

A trading-control disclosure is meaningful only when converted into a testable rule. For channel inventory, inspect which streams changed. Use a sandbox, non-production context, or the smallest reversible test available, then map every production subscription. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, undocumented clients is therefore an explicit audit gap.

The channel inventory row should end with a concrete monitoring rule tied to which streams changed. Make the operator map every production subscription, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; undocumented clients remains a separate production risk until observed.

2. Control test: Field semantics

For field semantics, inspect checksum fixed to zero. Use a sandbox, non-production context, or the smallest reversible test available, then remove checksum acceptance logic.

In this dimension, legacy parser behavior is therefore an explicit audit gap.

The field semantics row should end with a concrete monitoring rule tied to checksum fixed to zero. Make the operator remove checksum acceptance logic, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; legacy parser behavior remains a separate production risk until observed.

3. Control test: Sequence link

For sequence link, inspect prevSeqId to prior seqId. Use a sandbox, non-production context, or the smallest reversible test available, then reject broken continuity.

In this dimension, reset semantics is therefore an explicit audit gap.

The sequence link row should end with a concrete monitoring rule tied to prevSeqId to prior seqId. Make the operator reject broken continuity, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; reset semantics remains a separate production risk until observed.

4. Control test: Snapshot

For snapshot, inspect authoritative restart state. Use a sandbox, non-production context, or the smallest reversible test available, then replace rather than merge suspect state.

In this dimension, snapshot latency is therefore an explicit audit gap.

The snapshot row should end with a concrete monitoring rule tied to authoritative restart state. Make the operator replace rather than merge suspect state, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; snapshot latency remains a separate production risk until observed.

5. Control test: Delta order

For delta order, inspect strict application order. Use a sandbox, non-production context, or the smallest reversible test available, then serialize per instrument.

In this dimension, cross-connection ordering is therefore an explicit audit gap.

The delta order row should end with a concrete monitoring rule tied to strict application order. Make the operator serialize per instrument, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; cross-connection ordering remains a separate production risk until observed.

6. Control test: Duplicates

For duplicates, inspect equal or repeated sequence cases. Use a sandbox, non-production context, or the smallest reversible test available, then follow documented exceptions.

In this dimension, future feed changes is therefore an explicit audit gap.

The duplicates row should end with a concrete monitoring rule tied to equal or repeated sequence cases. Make the operator follow documented exceptions, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; future feed changes remains a separate production risk until observed.

7. Control test: Reconnect

For reconnect, inspect connection loss and service notices. Use a sandbox, non-production context, or the smallest reversible test available, then resubscribe and rebuild.

In this dimension, missed transition is therefore an explicit audit gap.

The reconnect row should end with a concrete monitoring rule tied to connection loss and service notices. Make the operator resubscribe and rebuild, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; missed transition remains a separate production risk until observed.

8. Control test: TLS

For tls, inspect transport confidentiality and integrity. Use a sandbox, non-production context, or the smallest reversible test available, then validate certificates and WSS.

In this dimension, endpoint compromise is therefore an explicit audit gap.

The tls row should end with a concrete monitoring rule tied to transport confidentiality and integrity. Make the operator validate certificates and WSS, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; endpoint compromise remains a separate production risk until observed.

9. Control test: Monitoring

For monitoring, inspect gap, rebuild and stale-book counters. Use a sandbox, non-production context, or the smallest reversible test available, then alert on every resync.

In this dimension, silent consumer bugs is therefore an explicit audit gap.

The monitoring row should end with a concrete monitoring rule tied to gap, rebuild and stale-book counters. Make the operator alert on every resync, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; silent consumer bugs remains a separate production risk until observed.

10. Control test: Trading gate

For trading gate, inspect whether local depth can drive orders. Use a sandbox, non-production context, or the smallest reversible test available, then fail closed during uncertainty.

In this dimension, strategy impact is therefore an explicit audit gap.

The trading gate row should end with a concrete monitoring rule tied to whether local depth can drive orders. Make the operator fail closed during uncertainty, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; strategy impact remains a separate production risk until observed.

Decision scenarios

Scenario 1: when channel inventory becomes decisive

Consider a reader whose main constraint is which streams changed. The correct response is not to infer a universal platform or product winner. It is to map every production subscription, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when field semantics becomes decisive

Consider a reader whose main constraint is checksum fixed to zero. It is to remove checksum acceptance logic, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when sequence link becomes decisive

Consider a reader whose main constraint is prevSeqId to prior seqId. It is to reject broken continuity, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when snapshot becomes decisive

Consider a reader whose main constraint is authoritative restart state. It is to replace rather than merge suspect state, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when delta order becomes decisive

Consider a reader whose main constraint is strict application order. It is to serialize per instrument, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when duplicates becomes decisive

Consider a reader whose main constraint is equal or repeated sequence cases. It is to follow documented exceptions, retain the evidence, and define a stop condition before funds or permissions are committed.