An upstream feed resets ten thousand of your prices to a penny and orders start arriving. What should have stopped it, and what do you do with the orders that got through?
Nothing in the pricing engine was broken, so the control has to sit on the change itself: bounds relative to the previous price and the cost, a rate limit on bulk movement, and a kill switch. Then pause dispatch before anyone debates whether to honour the orders.