A provable log you never verify is a readable log. Verification is one call: GET /v1/audit/verify checks the newest 1000 entries plus every checkpoint; ?limit=0 recomputes the whole chain and full Merkle tree. A background check re-verifies the newest window every five minutes, and GET /v1/audit/status serves the last verdict at constant cost — before the first run it answers never-verified, reported as exactly that, never as intact. The verifier reports precisely what it examined: a windowed check never claims the whole chain. Run the full verify nightly from cron, and after any restore — the five green checks of your very first install included "status":"intact" for a reason.
When the verdict is tampered, treat it as a security incident, not an ops warning: preserve the database before any further writes, identify the first bad sequence, correlate with database access logs. One exception to check first: problems of kind chain-forked are concurrent appends from an older build — genuine records, nothing removed. The one thing a broken chain cannot tell you is who; that comes from the surrounding evidence.
Now I can prove my audit log intact on a schedule, not on faith.