The co-pilot reads the record over FHIR, computes what changed, and verifies every claim before showing it.