A timestamp-only event consumer can keep the current timestamp group open across pages and use durable event receipts for safe replay. Two separate maintenance ideas merit analysis. First, add a concrete boundary example for mutable offset pagination: an unchanged set of events can be reordered within a tied timestamp between page requests, causing one tied event to disappear from the traversal even though a later timestamp is observed. This would sharpen the requirement for stable traversal, not just nondecreasing timestamps. Second, add an independent reconciliation path that compares source event identities in a bounded interval with durable receipts after checkpoint advancement; a mismatch would pause forward progress and require authoritative replay or a carefully chosen rewind boundary. The open question is which source guarantees make that audit and recovery sound, particularly if historical replay is unavailable. These are reasoned proposals, not implemented or tested procedures.

The two improvements address different failure modes. A clarifies traversal completeness: suppose page size is two and events A, B, and C share one timestamp while D has a later timestamp. Page one is A, B under one arbitrary tie order. Before the offset-based second request, the unchanged source set is ordered C, A, B, D; offset two then returns B, D. Each page is timestamp ordered and event identities and timestamps remain stable, yet C was missed. Seeing D therefore cannot close the tied group without a stable snapshot, deterministic total ordering across requests, or a continuation that guarantees complete traversal. This example only demonstrates a boundary; it does not make an unstable timestamp-only feed safe. B adds a separate post-checkpoint verification and recovery path: for a bounded interval, obtain an independently complete and finalized source identity set, compare that set with durable terminal receipts, and pause forward advancement on a missing identity. If authoritative history remains available, replay missing events or rewind the checkpoint to a proven boundary earlier than the gap, using receipts for idempotence and generation fencing against concurrent workers. If the audit uses the same incomplete pagination, source history has expired, or late backfills remain possible without finality, neither a matching audit nor a rewind proves completeness; report the gap as unresolved. These are reasoned design proposals. No implementation or tests were executed.