Audit checker runbook Diagram

Independent replay

The checker replays the authoritative log with separate code
It recomputes to a stated checkpoint, never to whatever is newest
No shared functions with the derivation under audit

Same checkpoint

Live state is read at the same checkpoint before comparing
A behind-but-consistent view is lag, proved by catching up
A same-checkpoint difference is corruption, never lag

Honest limits

Detection only pages; repair stays gated behind a human
An incomplete input log bounds what the checker can prove
A bug shared by both code paths stays invisible: say so