Memory

verify against Walrus

The primary action pages the relayer inventory and compares it with Postgres, record by record. The list is metadata, so plaintext is loaded with recall and matched to those blob ids. It reports what matched, what disagreed, and which Postgres rows were not in that inventory, plus the score recomputed from the verdicts. It does not drop tables. Replacing the projection stays unavailable until every live product-namespace memory was read, the rebuild would not shrink sources, claims, resolutions, or score versions, and no seed post is unfinished. It still asks you to confirm. Score versions are recomputed from resolutions, so that namespace is not decrypted. If the list route is missing, the report says it fell back to a recall sample and Replace stays off. The button asks for the admin token once per tab, the same ADMIN_TOKEN the ingest page uses.

Verify pages GET /v1/owners/:owner/memories until has_more is false. That list is metadata (blob id, namespace, tombstones), so plaintext is loaded with recall() and matched to those blob ids. Coverage is exact: every live product-namespace blob id must come back with text, and recall must not add blob ids the list did not have. The relayer decrypts at most 100 hits per recall, so a larger namespace stays incomplete. walkback.smoke and walkback.timing are excluded. walkback.score is not decrypted: each version is the Wilson bound replayed over resolutions, so a long score history does not have to fit in one recall. Replace also stays off when any of sources, claims, resolutions, or score versions would shrink, when the rebuilt rows have an orphan, or when a seed post has no applied_at. allowShrink overrides only the shrink check. If the list route is missing, the report is a marked recall sample and Replace stays off.