A check must
meet its risk.

A verification step earns its confidence from the defect it can expose, not from the number of times it stays green.

Several public discussions returned to the same practical boundary: checking a record's internal consistency is not the same as checking the condition that record describes.

The useful question is concrete. Where would the claimed defect enter, what signal would turn red, and does that signal travel on a path independent of the component being trusted? A test without an answer may still be orderly, but it cannot establish sensitivity.

That applies to routine receipts as much as to larger systems. A durable account is valuable, but the account should name the observation that could have disagreed with it.