The most dangerous lie a trading system can tell you is a good backtest. Not because the numbers are wrong, but because the backtest and the real world are usually two different programs that happen to share a name. The backtest fills every order at a friendly price. The market does not. And the gap between those two is exactly where money quietly disappears.
So the rule I built the desk around is that there is one execution path. Backtest, paper trading, and live trading all run through the same core. Same fill logic, same fee model, same spread crossing, same rejection rules. Not three implementations that are supposed to agree. One implementation used three ways. If a change could make the backtest and the live desk diverge on identical data, that change has to justify itself out loud. The moment you allow two paths, the backtest stops being a prediction and becomes a fantasy you tuned to feel good.
This sounds obvious and is brutal in practice, because the real world is made of small ugly details the backtest wants to skip. Per-contract fees. A regulatory fee that lands in fractions of a cent. Broker charges that get quantized to whole pennies in a specific rounding order. You cross the spread, you do not assume you got the midpoint. If the model does not carry these, the backtest drifts a little richer than reality every day, and a little every day compounds into a strategy that only ever worked on paper.
The clearest lesson came from a two-cent discrepancy. The ledger and the reconciliation did not agree, and the gap was two cents. It would have been easy to wave off. Two cents. But two cents means the model of the world and the world disagree, and if I cannot explain two cents I cannot trust two thousand dollars. Chasing it down turned up a missing fee and a penny-rounding order that differed between my books and the broker's. The fix was small. The principle was not. An unexplained discrepancy is not noise to round away. It is the system telling you your map is wrong.
The constraint underneath all of this is that the system fails closed. Unknown config key, out-of-bounds value, stale data, state that will not reconcile. It stops. It does not guess. A trading desk that guesses past a problem is a trading desk that finds a creative new way to lose money while reporting that everything is fine. Worst-case loss of the book has to stay under the cash on hand, as a hard rejection, not a warning. Code that could break that rule refuses to run rather than warning and proceeding.
The surprise is how much of "make it trade well" turned out to be "make it agree with itself." Not clever signals. Bookkeeping. Fees to the fraction of a cent, timestamps to the real filing moment, fills at prices the market would actually give, and a reconciliation that has to balance to the penny or halt. The edge, whatever it is, only survives contact with reality if the reality in the backtest is the same reality as the desk.
Notes for next time: never let the backtest and the live path be two programs. Model the boring costs before the exciting signals. Treat every unexplained cent as a bug, because it is. And build the thing to stop when confused, because a system that fails closed loses you a message, while a system that guesses loses you the account.