Replay

Replay takes one side of one closed run and projects its ledger into a bundle you can play. It boots nothing, calls no model, and does no input or output beyond fetching artifacts by hash. Given the same ledger it produces byte-identical output, and the time you ask for it does not enter the result.

The rule it exists under: a replay is a reconstruction of what the ledger already recorded. It never becomes a second record of what happened, and it never underwrites a PASS.

Every byte in a bundle carries a preimage — the ledger entry or the artifact hash it came from. A byte with no preimage is a defect, not a rendering detail.

Two neighbouring operations are worth separating. Verifying a run re-executes its oracles over the stored artifacts and recomputes the verdict hash — cheap, offline, no environment. Re-executing a run re-provisions the environments and runs the plan again, which is what catches environment drift and costs what a run costs. Replay is neither: it is a projection.

A bundle has eight lanes, and a manifest lists each exactly once. A lane that has nothing in it is marked absent — a value the projector wrote, not a lane the player left out.

visual

What the application looked like. Presentation only; never an oracle input. It is a browser recording, a terminal cast, an assistant transcript, or a request waterfall, depending on the boundary that was driven.

action

The lifecycle of each compiled action and the stimulus it sent.

network

Protocol-framed messages on the wire, in both directions.

server

Unframed process output, exits, and breakage below the application.

database

State changes observed independently of the application.

artifact

Complete blobs the broker ingested.

oracle

Readings, each linked to the evidence it consumed. A result on this lane is a link into the ledger, never a badge the player invented.

chapter

Non-overlapping intervals derived from the plan that actually executed.

The playhead, every cursor, every chapter boundary and every join runs on the broker's clock. A source's own timestamp is never adjusted to make a child nest neatly or a frame line up — that would be a defect in Certus, not a display option.

Because sources have their own clocks, each is aligned against the broker's and the quality of that alignment is stated: exact, approximate, or unaligned when there was nothing to align against. Video is placed using an observed epoch plus the recording's own monotonic time, because a wall-clock media timestamp can step backwards.

Seeking always answers. Ask for any moment on any lane and you get one of: here is the frame, nothing has happened yet, there is a gap here, this lane has ended, or this lane is absent.

The visual lane can be full, reduced to sparse snapshots, or absent, and which one it is is declared on the bundle rather than degraded silently. Reducing visual fidelity never changes a grade.

Replay is idempotent on redacted bytes: what was redacted stays redacted, and a redaction reference is carried through, never inverted. Changing a redaction policy produces a new projector version and a new bundle; it never rewrites an existing one.

The player verifies the hash of every object it renders, and bundles can be exported as a digest-bound archive so a third party can open the reconstruction without calling Certus at all.

The bytes did not hash to what the manifest names

The serious one. Certus will not paint evidence it cannot verify, so the pane stays empty. Report it.

The short-lived grant for a segment expired

Routine. Re-reading the bundle mints a new one.

A lane is absent

Nothing produced into it, or the artifact it needed has been collected under retention. The projection succeeded either way; the absence is a fact about the run.

The view says it is inconclusive

The projection and the ledger disagree. The ledger is not changed, the bundle is not rewritten, and the verdict is untouched — a replay view is not a verdict status.

The run is still going

There is no bundle yet. Replay projects closed runs, because a projection of a moving ledger is not reproducible.