Level 2 spoofing tells — what I log vs what I invent

[Fairman]

Level 2 "spoofing tells": what I log versus what I invent.

Maybe-signal patterns I bother recording:

- Size that appears and vanishes at the same price repeatedly.
- Size that pulls as the market approaches.
- Stacked size that never trades when hit.

Even then, it's a log entry, not an automatic fade.

Not enough:

- One refresh I didn't like.
- Chat said spoof.
- Absolute size without relative context for that name.

Action rule: never override a written trigger on a spoof story. Log time, price, size, and what happened next. Review weekly. Patterns only after N samples. Otherwise you're writing fiction in real time.

A worked example of a log entry. 10:07 ET, liquid mid-cap, price $58.30 bid / $58.31 ask. A 15,000-share offer appears at $58.40, much bigger than the other levels on that side. Price climbs to $58.37 and the offer disappears. A minute later it shows up again at $58.40, then pulls again as price reaches $58.38. That's two appear-and-vanish cycles at the same price, so it qualifies as "maybe" on my list. The entry reads: 10:07, $58.40, ~15k, pulled at $58.37 and $58.38, price traded through $58.40 at 10:10 and held. Then I close the notebook.

What I did not do: short it because "someone is hiding size," or buy it because "the spoofer is about to give up." My written trigger for that name was a hold above $58.25 after a pullback. That trigger fired earlier and I was already in with invalidation at $58.18. The book games didn't change the plan in either direction.

After enough entries like that, the weekly review sometimes shows a loose pattern for a specific name and time of day, and sometimes shows nothing at all. Both are useful. Nothing at all is the more common answer, and that's the lesson.

Failure modes:

- Logging only the cases where "the spoof worked," which makes the pattern look stronger than it is.
- Deciding N after looking at the results.
- Treating a single large print as proof of anything.

When to skip logging entirely: fast opens where I'm executing a plan, halts and reopenings, and thin names where the book is too jumpy to describe honestly.

Month-one traders should mostly ignore spoof narratives entirely (see the beginners thread). This checklist is for people who already refuse to let the book veto the plan.

Diagram: maybe / not enough / action rule.