The rule was in the spec and the backtest — everywhere except the code

Our NG-7 paper system had a 4-hour signal expiry rule. It was in the spec and in the backtest, but it was never put into the live code. Day one filled in about 3 minutes and went 9 for 9. The next batch sat unfilled for 67 hours over a weekend, filled at the Sunday reopen off a stale snapshot, and went 1 for 9. Every loss in that batch traced to the stale fills, not the picks. We added three guards: signals expire after 4 hours, nothing carries over a weekend unfilled, and the crowd book is re-checked at fill time. Replay now shows batch one still fills 9 of 9 and batch two expires 9 of 9. It stays paper only.