You need one consolidated best bid and offer across five venues whose feeds arrive at different latencies. How do you build it, and what will it get wrong?

There is no global sequence, and that is the whole problem

Each venue publishes its own stream with its own monotonic sequence numbers. Those numbers let you prove that you have every message from that venue and that you are applying them in the order the venue produced them. They tell you nothing whatsoever about the relationship between an update on venue A and an update on venue B, because the two streams are independent and travel different paths.

So the composite is not a merged stream. It is a function over five independently maintained books, recomputed when any one of them changes. Build a book per venue exactly as you would if it were the only one, then hold a small structure over their tops, at most a handful of entries, and recompute the best bid and best offer on each change. With five venues the recomputation is a scan of five values, which costs nothing; the temptation to be clever with a heap is misplaced at that size.

The composite also needs its own version number and its own timestamp, so that a downstream consumer can say which composite it acted on. Without one you cannot answer, later, why the router chose the venue it chose.

Two clocks, two jobs

Every update gives you at least two times: the venue's own timestamp on the message, and the time your handler received it. Both are useful and they answer different questions, and mixing them is the most common defect in this kind of system.

Local receive time is what your own decisions must use, because it is the only time that reflects when you knew something. Your router cannot act on information before it has it, so the causal history of your own system is ordered by receive time. Local time is also what you use to measure your own infrastructure, since the difference between receive times on two lines is a fact about your paths.

Venue timestamps are what cross-venue analysis and reporting must use, because they are the only times that describe when things happened in the market rather than when they reached you. Reconstructing whether a print on one venue preceded a quote change on another needs venue time. It also needs your clocks to be genuinely synchronised: MiFID II obliges firms to keep their business clocks within a documented tolerance of UTC and to record the traceability of that synchronisation, and ordinary network time protocol over a general network does not get you to the microsecond end of that requirement. That is why trading floors take a hardware time source and distribute it with a precision protocol.

Unequal latency manufactures crossed markets

Suppose venue B reaches your handler in 200 microseconds and venue C in 2 milliseconds, because C's feed traverses a longer path or a slower gateway. The difference is 1.8 milliseconds. Now the market moves down on B. For those 1.8 milliseconds your composite holds B's new, lower offer alongside C's unchanged, higher bid, and reads as crossed: a bid above an offer. Nothing anomalous happened in the market. You are looking at two photographs taken at different times and treating them as one scene.

The cost is concrete rather than cosmetic. A router that believes it can buy on B and sell on C for a profit sends orders into a state that has already gone, and the usual outcome is that the passive side is not there and you are left with one leg. So a crossed composite is not an opportunity signal, it is a staleness signal, and a system that cannot tell the difference will systematically trade against its own lag.

The same asymmetry is why direct feeds and the official consolidated tape diverge. In the United States the consolidated tape is assembled and republished by the securities information processors, which necessarily adds a step that reading the exchange's own feed does not, and much of the argument about latency arbitrage is an argument about the size of that gap. A firm subscribing to direct feeds sees a different best price from a firm reading the tape, and both are correct about what they can see.

Liveness, because silence is ambiguous

A venue that has sent nothing for two seconds is either quiet or gone, and the composite must not guess. Resolve it with two independent mechanisms. The feed's heartbeat proves the transport is alive when there is no data; its absence past a defined interval marks the venue unknown. Sequence-gap state proves the book is whole; a venue in recovery is not contributing a book, it is contributing an unreliable one.

// Per venue: contribute only if the book is whole and the feed is alive.
// The composite carries the reason it is degraded, because a router needs
// to behave differently when a venue is absent than when it is merely wide.
boolean contributes(VenueBook v, long nowNanos) {
    return v.inSync()                                  // no unfilled gap
        && nowNanos - v.lastMessageNanos() < heartbeatToleranceNanos
        && v.hasBothSides();                            // one-sided is not a quote
}

Excluding a venue is only half the design. The other half is what the consumer does with a degraded composite, and that must be decided by the consumer rather than hidden by the producer. A pricing screen can display the remaining venues with a marker. A router must treat the excluded venue as unavailable rather than as showing its last known price, because sending an order to a venue whose state you do not know is how you acquire a position you did not intend. And a best-execution record has to note that the venue was excluded, because a decision that looks poor against the full market was reasonable against the market you could actually see.

Reproducibility is a capture decision, not a logging decision

Every question anyone will later ask about a routing decision reduces to what the composite held at the moment of the decision. That is answerable only if you journalled each venue's raw messages with the receive timestamp and the arrival sequence you assigned, and if the composite is a pure function of that input. Then a replay reconstructs it exactly.

Two things break the purity if you let them. Wall-clock reads inside the logic make the output depend on when you replay rather than on what you received, so time has to enter as a sequenced event like any other input. And ties need a deterministic rule: when two venues' updates carry identical timestamps, the composite must break the tie the same way every time, on venue identifier or on your own arrival sequence, or a replay will occasionally produce a different best venue from the live run and nobody will be able to say which was right.

The distinction that carries the answer

A consolidated quote is a derived, versioned estimate with a validity window, not a measurement. The strong answer says so early and then spends its time on how the estimate degrades: which venue you have stopped believing, how you know, how stale the freshest contribution is, and what the consumer is entitled to assume. The weak answer merges five feeds into one book, sorts by price, and has quietly asserted that five clocks and five paths agree.