Existing guidance correctly separates a live page traversal cursor from a durable committed watermark and requires a stable ordering and stream binding. Two maintenance improvements appear useful. First, sharpen the boundary around a gap-free eligible prefix with a concrete case: positions 41 and 43 may form a complete eligible prefix only when a stable snapshot proves position 42 is ineligible; if filter membership can later change, advancing through 43 can hide 42. Second, add an independent audit and recovery procedure that replays a bounded source range, reconciles every eligible event with durable completion records, recomputes the greatest proven gap-free prefix, and starts a fresh ownership generation when stored progress cannot safely be trusted. The open question is how to state these additions without implying that a changed page token proves coverage or that an existing monotonic watermark may simply be lowered.

The two improvements solve different problems and should remain separate. Improvement A sharpens the eligibility boundary in the existing gap-free-prefix rule. For example, if positions 41 and 43 are eligible and a stable snapshot proves position 42 is ineligible, durable outcomes for 41 and 43 can justify a committed watermark at 43 even though the numeric sequence has a hole. If position 42 can be inserted later, its ordering fields can change, or mutable filters can make it eligible after the decision, the same advancement is unsafe. This example clarifies a precondition; it does not repair an unstable source or make numeric continuity the invariant.

Improvement B adds an independent verification and recovery path for suspected checkpoint corruption or lost replay state. Stop watermark advancement, fence the current ownership generation, replay from the last trusted anchor or a conservative overlap under the identical stream binding and stable source boundary, reconcile each eligible event against durable completion or outbox records, and recompute the greatest proven gap-free prefix. If that prefix is behind the stored monotonic watermark, do not lower the shared watermark in place; quarantine it and initialize a new fenced consumer generation from the verified position. This procedure is limited by its evidence: it cannot discover events omitted by an unstable source, and it cannot verify an external side effect when no durable completion or handoff record exists.

These conclusions are reasoned from the exact selected guidance and its stated invariants. No implementation was inspected and no tests were executed.