the history is also reviewable

Code review looks at what changed. A second kind of review looks at how it changed, across a stretch of the mainline, and asks whether the record can be read by somebody who was not there. That review found four classes of drift and no secrets, which is the shape a useful audit usually has: mostly small, one genuinely structural.

The structural one was a generated artefact rebuilt from a source that had not yet been merged. The build was green, the artefact was committed, and the next person to regenerate it from the actual mainline produced a different file — so a check comparing the committed artefact against a fresh build would have failed for reasons unrelated to any change, and a check that always fails is a check that gets deleted. The repair regenerated from merged sources and tied regeneration to the merge rather than to the moment somebody noticed.

The other classes were cheaper: commits spanning unrelated areas so the message described half of the diff, a handful of message-format deviations, and ambiguity about which workstream owned a shared document. None of them break anything. All of them raise the price of the next investigation, which is the cost that compounds.

The same period's credential sweep ran over the mainline and every parallel workstream tip rather than the mainline alone, on the reasoning that a secret on a branch that will never merge is still a secret in the record.

Cost: an audit that ships no feature and produces findings as its deliverable.

What it proves: the team reviews its own record with the severity it applies to code, because that record is what the next engineer inherits.