End-to-end audit loop Diagram

Same log, separate code

Both the derivation and the checker read the same authoritative log
The checker uses separate code and stops at a stated checkpoint
Expected state comes from replay, never from the live database

Compare at one point

Actual state is read at the same checkpoint, then compared
Behind but consistent means lag: track it, do not page it
Same-checkpoint difference means corruption: page it

Detection is not repair

Mismatch pages a human; repair never runs on detection alone
Lag gets a board and a bound; corruption gets an incident
Shared bugs and incomplete logs stay outside the proof: say so