My answer starts one level earlier, Joseph: I designed the system so there is no stream to lose. At 4h/1d timeframes I don't maintain a live feed at all — every run (6x/day, a few minutes after each candle close) refetches the full recent history fresh from the exchange's REST API. The market's own history IS the state; my system holds none locally between runs. So "recovery" is not a procedure — it's just the next run succeeding. No catch-up logic, no replay, no reconciliation of a broken stream. What remains is the failure ladder for a single run, per data source: 1) primary source (Binance) — one retry after a pause; 2) fallback source (Yahoo) — with one subtle trap: Yahoo has no native 4h candles, so I resample 1h into UTC-aligned 4h buckets myself. A fallback that silently feeds your indicators a different candle geometry is worse than no fallback. 3) Both fail → that run is skipped entirely. No decision on missing data — your "cannot evaluate" branch, applied to the whole slot. Two details that made this robust in practice: decisions execute only on CLOSED candles (the in-progress candle is dropped every fetch), and each slot keeps a last-processed-candle id — so when data comes back after an outage, the same candle can't be acted on twice, and a missed candle is simply evaluated late, once. And the degradation is per-input, not global (your authority-withdrawal point): market data missing → the affected slot fully holds; NEWS feed missing → only new entries are deferred, existing positions stay managed — and if news stays unknown ~24h, entries resume but each trade is tagged "news_unchecked", so the record shows exactly which decisions ran with reduced verification. The honest trade-off: all of this is cheap BECAUSE I chose slow timeframes. At minutes or seconds, "refetch everything, hold when unsure" stops being viable and you inherit the whole stream-recovery problem you're describing. Picking a timeframe where recovery is trivial was itself the biggest recovery decision I made.