Prove whether OID/DIP sync is truly behind by comparing the profile’s LAST with actual cn=changelog entries, with clear ‘why’ and ‘what it means’ for each command plus a safe reset routine