Module replay 

Read-only OS audit snapshot rebuilt from append-only session events (Phase 6).

Does not reconstruct LoopStateMachine — only aggregates kernel OS events for introspection, tests, and tooling.

Structs

BudgetExceededRecord

OsSnapshot

Aggregated kernel OS state derived from session log (audit view).

ProcessRecord

SignalDisposedRecord

SuspendRecord

Functions

rebuild_os_snapshot_from_events

Rebuild an OS audit snapshot from session events (newest process state wins per agent).

session_log_has_required_categories

Returns true if every kernel OS event in the log carries an explicit category (Phase 6 native).