the verification pass that tidied up the live book

A replay was run to confirm that a change behaved as intended. The replay invoked the ordinary daily routine, and the routine began with a sweep: every entry not opened by the current pass was, by that definition, a day old and due to be closed. The replay had opened nothing. The sweep therefore closed the live book, hours before anything in it was due, because a verification happened to run the routine.

The defect was not in the sweep's arithmetic. It was that the routine had no way to know why it had been invoked. A scheduled pass, a manual rerun, a check of an unrelated fix — all identical from inside the code, and therefore all entitled to the same consequences.

The repair made the destructive step opt-in and named: only the invocation that represents the scheduled pass enables it. Replays, dry runs and manual checks close nothing. A test now asserts that a replay pass must close nothing, which is a strange sentence to have to write and an obvious one once written.

The same review found the mirror image — an untracked-position safety net that re-attempted closes on entries the sweep had just handled — and that duplication was removed.

What it proves: a read-only intention is treated as a property to be enforced rather than assumed, and the team asks what a routine will do when it is called for the wrong reason.