Function verify_chain 

pub fn verify_chain(branch: &[AuditRecord]) -> ChainStatus

Verify the integrity of a single branch’s records, assumed in chain order.

• index 0’s parent must be GENESIS_PARENT (else BrokenLink { at_index: 0 });
• each record’s id must equal its recomputed content-address (else Tampered);
• each record’s parent must equal the previous record’s id (else BrokenLink).

The Tampered check runs before the link check at each index, so a rewritten record is reported as tampering rather than as the broken link it would also cause downstream. An empty branch is vacuously ChainStatus::Ok.