Define what failure means
Loss of TCP connectivity is obvious, but a source can also be unhealthy because updates are stale, instruments disappear or messages fail validation. Health criteria should combine the signals relevant to the deployment.
Choose the failover scope
Some systems switch an entire connection; others switch an asset class or individual symbol. Smaller scope can reduce disruption but requires more detailed health and policy state.
Prevent oscillation
If a recovering source repeatedly crosses the health threshold, immediate failback can cause rapid switching. A recovery hold period or other hysteresis can make behaviour more stable.
Rebuild downstream state
After a source transition, consumers may require a fresh snapshot or explicit status transition. The system should not assume that an incremental update alone is enough to reconstruct state.
Test intentionally
Disconnect, stale-data and partial-symbol scenarios should be exercised in a test environment. A failover rule that has never been tested is only a configuration assumption.
How this applies to a broker deployment
The exact architecture depends on the selected sources, instruments, platform, regions, data rights and operating model. PriceFeed.xyz scopes those requirements before defining a production design. The examples in this guide explain engineering concepts and do not imply a specific source entitlement, hosting location, latency guarantee or service-level commitment.