September 2026
We run a paper book on tokenized equities. Over four days it reported +$858.91. When we checked whether those fills could actually have happened, +$340.43 survived.
We were not careless with it. The book already modelled a delay between signal and execution, abandoned trades whose price moved against it before the buy landed, used measured settlement times per route, and carried a rule meant to stop it trading a venue harder than that venue really trades. Every one of those was written deliberately, by people looking for exactly this class of error.
It was still wrong by a factor of 2.6, and it stayed wrong for days, because each individual mechanism was defensible and invisible until measured directly.
This is what each one looked like.
One venue produced most of the book's profit, and its liquidity looked adequate — it was reporting several times more daily turnover than the book was pushing through it. The capacity rule divided by that figure and reported the book as comfortably inside its own limit.
It was not. The venue's reported turnover had multiplied in two days, because reported turnover rises with the very activity that opens the dislocation. Somebody trades the venue, the price moves, a gap appears against another market, and the volume figure the capacity rule divides by goes up at the same moment.
A bound denominated in trailing volume is loosest exactly when it should be tightest.
Measured against the quieter depth that was there before the crowd arrived, most of the venues the book traded were past their real capacity on an ordinary day — and so was most of its flow, and most of its reported profit.
We spent a night deciding whether two venues ever disagreed enough to trade. They appeared to, and the edge looked substantial — and it grew, monotonically, over several minutes.
That growth should have been the tell, and it took three wrong answers to see it.
One venue's quote was parked. We were re-reading it on a fixed interval, so by our own freshness rule every comparison passed. But the quote had not been repriced — it had only been re-fetched. The other venue moved underneath it, and the apparent edge was simply the age of the stale side.
Freshness of your read is not freshness of the market. We had conflated the two, our rule measured the wrong clock, and the entire finding was an artifact of our own sampling rate. When both sides were read together, the crossings disappeared.
A point worth separating: on an automated market maker a stale quote is still executable, because its price comes from reserves. Staleness there does not invalidate the fill — it invalidates any edge you measured against a different venue. On an order book, the stale quote may simply be gone. The two need different treatment and are usually given the same.
Dislocations do not wait. We measured how long ours survive, from our own recorded tape, and the largest opportunities were the shortest-lived — which is the opposite of convenient, because they are also the ones a backtest books most profitably.
A simulation assuming instant fills collects every one of them. A real executor arrives late and finds most of them gone.
This is the check where the answer depends on an assumption the customer usually has not made explicit, so the useful output is not a verdict but a sensitivity: not "your backtest is wrong", but "how fast do you have to be for this to exist at all". On our own book that curve is close to flat at the speeds we actually run, and falls away sharply well beyond them. Yours will sit somewhere else, and knowing where is the point.
The capacity bound no longer trusts a venue's own recent activity to tell it how much that venue can absorb. The freshness rule now measures when the market moved rather than when we looked. And the book reports what it signalled separately from what the market then did while it held the position, because reporting the sum told us nothing about either.
Then we built the checks into a tool that runs against anyone's fills — because if we could be wrong this way with this much care, so can other people.
Our fill model has not been validated at scale against real fills. The machinery for simulated-versus-actual reconciliation exists and runs, but the sample does not exist yet, and until it does every claim here rests on internal consistency rather than on ground truth.
We would rather say that plainly than have a customer discover it.
Delta checks which fills in a backtest would not have happened. Send a file of the fills your backtest assumed; we tell you which ones the venue could not have absorbed, which were taken against prices that had not moved in hours, and which had closed before your order could land.