The copied stop was looser than mine
Everyone who mirrors the book is supposed to carry the same exit as the book. Then I diffed the published file against the live one: twelve days stale, and five of twelve exits looser than the ones protecting my own money.
The rule is deliberate: anyone replicating the model book carries the same stop as the book, looked up by name — never computed from their own entry price. A person who joins late buys higher, and a stop derived from their fill would sit mathematically worse than mine. Same holding, same exit. That is the fairness contract.
The code honoured it perfectly. Every replicated order looked its stop up from the published model file.
The published model file was twelve days old.
I found it by accident, diffing it against the live book. Five of twelve holdings carried a looser stop in the published file than the one protecting my own position. Anyone mirroring the book would have ridden a deeper drawdown than me — while the code enforcing “same stop for everyone” ran flawlessly on every order.
How a synced file goes stale
Two things conspired, and neither was a bug in the usual sense.
First, stop raises happen editorially. When a position moves up, the exit gets tightened during a review session — a human judgement, applied to the working file. There was no deterministic script call to hook, so nothing propagated the change.
Second — and this is the one that stung — the publishing pipeline contained a function named model_from_book(). Read that name and you relax: of course the model is derived from the book, it says so. It wasn’t. It re-read the already-published model file and returned it. The function’s name described the intention of whoever would eventually finish it, not the behaviour of the code as written. Nothing else wrote fresh stops into the file, so it aged silently, one tightening at a time.
The fix, and the shape of the fix
A small script now reads the live stops table, overwrites the published file’s stops for every matching name, and runs before the publish step in the evening chain — so the day’s publication carries the day’s actual exits. A morning heartbeat re-verifies, because the first fix stranded twice (a machine asleep at the wrong moment, a transient import error) before it became self-healing.
Deliberately, the sync only touches names present in both files. It will not add a holding to the published model, and it will not delete one — either difference is surfaced as a finding for a human, because a sync script that silently reshapes a published document is a different and worse bug.
The two lessons I keep
A mirror without a pump is a photograph. Any “published copy” of a live thing is stale by default. The question is never is it synced but what process moves the data, how often does it run, and what alarm fires when it doesn’t. If you cannot name the process, you are looking at a snapshot from whenever someone last ran something by hand.
Function names are claims, and claims get audited. model_from_book() read like documentation and functioned as a decoy. The habit I have adopted from accountancy: verify the flow, not the label. A ledger account called “Reconciled Suspense” tells you what someone hoped, not what happened.
The part that keeps me honest: the failure was invisible from inside. Every test passed, every order placed, every stop looked up exactly as designed — from a file that time had quietly falsified.