The object every production system gets wrong
A filtration F_t answers a legal question, not a modelling question: what is it lawful to know at time t? It has no natural home in a dataframe, which is exactly why it's the object most pipelines get wrong. Chapter 4 already fixed the shape of this answer for frames -- a frame card naming which quotes, which convention, and which as-of are admissible is a filtration claim wearing operational clothes. Chapter 6's as-of hash H is the machine representation of F_t: a content hash over features whose ancestors all print at or before the decision clock. Without H, "the model said 1.50" is a story. With H, it's a contract that can be replayed and therefore refused.
Worked picture
Take a CEH-001 desk day with three clocks. Under the spread frame the honest opening mark at 09:40 is 1.50. Two independent, mean-zero shocks land during the day: a spread-factor move A, revealed at 14:00, worth ±0.40; a curve revision B, revealed at 14:20, worth ±0.10. The settle mark is Y = 1.50 + A + B. At 09:40, before either shock, the honest forecast is 1.50. At 14:00, once A is known, the forecast splits to 1.90 or 1.10 -- and checking the tower property, 0.5(1.90) + 0.5(1.10) = 1.50 exactly, so the rooms are consistent. The 14:00 room is genuinely sharper (conditional variance drops from 0.17 to 0.01), but that sharpness cannot be backdated to 09:40.
On the realised path, A = +0.40 and B = -0.10, so Y = 1.50 + 0.40 - 0.10 = 1.80. A challenger whose feature pack is labelled as-of 09:40 but whose curve column silently carries the 14:20 revision publishes exactly 1.80 at 09:40 -- and on this path its exam error is zero, while the legal model that published 1.50 books an error of 0.30. The forbidden midpoint wasn't produced by a committee splitting the difference. It was produced by an illegal information room, and the exam then paid for the violation with a 0.30 accuracy improvement.
The gate that catches this reads the dependence structure, not the error. The legal model's 09:40 output has zero correlation with B by construction; the leaked model's is a deterministic function of B. Any measurable dependence of a published t-mark on a post-t print is a hard refuse, coded LEAKAGE_FUTURE_PRINT -- and because the published float is also the denied midpoint, the same ticket carries DUAL_MARK_MIDPOINT. No confidence interval rescues you here, because the leaked model really is more accurate. That's the whole point of a hard gate instead of a soft statistical one.
Soft leakage: when every timestamp still looks legal
The sneakier failure never touches a future row at all. A peer z-score feature normalises CEH-001's mark against its own recent history. Fit the scaler on the legal Monday-through-Thursday window and Thursday's z-score comes out +0.295. Fit the identical scaler over the full week -- including Friday's gap, because a convenient pipeline runs on a weekly partition -- and the same Thursday value scores -0.375. The feature flipped sign, not magnitude, and every row still carries a legitimate Thursday timestamp. The leak lives in the statistic, not the observation, so no timestamp canary can see it. The fix is a lineage rule: the fitting window of every aggregate, scaler, or peer basket is itself an ancestor with an as-of, and it has to satisfy the same legal-information constraint as any print.
Adapted versus predictable: the rule that saves a backtest from itself
Two adjacent words carry a rights distinction. A process is adapted if its value at t is knowable once you're at t. A process is predictable if its value is knowable strictly before the move it covers. Marks are adapted. Hedge holdings must be predictable -- and the distinction is invisible in continuous-time notation and lethal in a backtest.
On a one-period binomial market (up 1.10, down 0.90, gross rate 1.05, a call struck at 100), the legal hedge commits to 0.5 shares before the move, funds it with -42.86 in the bank, and prices the call at 7.14. Let a vectorised backtest choose the holding after observing the move instead -- one off-by-one row alignment -- and the strategy matches the payoff exactly with zero capital, implying a price of zero and an unbounded Sharpe ratio. Nothing in the arithmetic is wrong; it's answering a question about a market where holdings are adapted rather than predictable, and that market permits free lunches. The signature on a report is a hedge whose tracking error is implausibly small and a premium that drifts below any no-arbitrage floor. When a replication result beats 7.14, look for the off-by-one before you look for the alpha.
Martingales as a test on leftovers
A martingale isn't a claim about markets being fair. It's a test on leftovers: after a model removes the drift or hedge it claims to remove, what remains must not still predict P&L. The tower fixture above already contains one -- the legal mark process M is a martingale because A and B are mean-zero and revealed at their stated clocks. The leaked model's mark process is not even adapted to the filtration it claims, since its 09:40 value depends on a 14:20 print. Leakage and martingale failure are the same defect seen from two angles: one asks what did you know, the other asks what should have been unforecastable.
Optional stopping: why the exam is frozen
A stopping time is a random moment decided using only information available when it occurs. "The first day cumulative edge hits +2%" qualifies. "The best twelve-day window in the sample" does not -- deciding it needs the whole sample, a room the desk didn't occupy while the window was running. Run a zero-skill challenger as a driftless ±1 random walk that gets promoted the first time its edge reaches +2, or killed once it reaches -10. Gambler's ruin gives the probability of hitting +2 first as 10/12 ≈ 0.833. A skill-free challenger produces a promotable-looking result five times in six, and the mean is still exactly zero -- the promote queue just never sees the -10 tickets, because nobody writes them. This is why exam packs are frozen and hashed before unblinding, why the minimum detectable effect is pre-registered, and why continuous monitoring runs on e-processes instead of repeated confidence intervals: an e-process is built so its expectation stays bounded under the null at every stopping time, which is the mathematical content of "you may peek at this one."
The time grid is a ruler too
Every continuous SDE is executed after a discretisation choice -- the step size, the integrator (Euler-Maruyama, Milstein), and the stochastic interpretation (Ito or Stratonovich) are four fields of a scheme card, and a scheme conflict is a frame conflict by another name. Hand the identical written SDE to two teams, one reading the noise term as Ito and one as Stratonovich, and their terminal means separate to 1.50 and 2.10 -- a gap of 0.599, numerically indistinguishable from Chapter 4's honest frame gap, bracketing the same denied 1.80. Refining the grid moves the fourth decimal place and leaves the interpretation gap untouched, because it isn't a discretisation error at all; it's two different processes wearing one equation. Worse, coarsening the grid to a single annual step compresses the gap from 0.599 to 0.336, and a desk with a 0.40 tolerance will now record "the schemes agree" -- the coarse grid didn't resolve the conflict, it hid it, in the direction that lets a meeting end.
Weak error (how wrong the expected payoff is) and strong error (how far the simulated path wanders from the true one) converge at different rates -- Euler-Maruyama is first-order weak, half-order strong. Halving the step halves the weak error but removes only about 29% of the strong error. A team that refines the grid fivefold and reports "error down by a factor of five" has quoted the weak column while their lease spends against the strong one.
What breaks in production
The interpretation gap in the worked fixture (0.599) is roughly twelve hundred times larger than the daily-grid bias (0.00049). No amount of refining the mesh touches it, because it isn't a mesh problem. And the reverse failure is worse: a coarse grid can quietly manufacture agreement, compressing a real conflict into something that reads as consensus on a dashboard. The remedy is a scheme card with a hashed identity (step, integrator, interpretation, seed) and a fan-out test that reruns the same challenger under every declared scheme before anyone gets to average, or worse, forget that averaging happened at all.
Key idea
Classical probability serves refuse edges here; it does not mint alpha passports. Lock the frames (Chapter 4), declare F_t by as-of hash and test every published mark and every aggregate's fitting window for dependence on post-t prints, require hedge holdings to be predictable rather than merely adapted, keep residuals martingale-honest under the declared measure, freeze and hash the exam before unblinding, and evaluate under exactly one declared scheme card. A gap's size never diagnoses its cause -- a frame gap must be preserved as dual marks, a scheme gap must be closed by declaring the missing field. Only the card tells you which one you're looking at.
Book: Chapter 5 in Rulers Before Models.