Real use is the best test suite there is. With $padRecord = TRUE in _config/config.php, every GET request the application answers with a 200 is kept with its answer; develop/?replay later asks every one of those pages again, against the code as it stands, and names each page whose answer changed and the first line where it parts from the recording.

A name instead of TRUE picks the store, DATA/replay/<name>/, one file per URL; ?page&padRecord=name records one request of this machine's own.
Only a request that brought no cookie but PAD's own two ids is recorded: one with a session or a login cannot be replayed faithfully, because a replay comes without cookies. Neither is an answer holding a token its request made - the CSRF token of a form, the CSP nonce - which a replay gets anew.
The host an answer was recorded under counts as the host it is replayed on.
An answer that changed on purpose is accepted - it becomes the recording - and a page that changes every time, a clock, is deleted from the store.

A replay must never write. While one runs, db() refuses every statement that would change the database - it answers 0, as if no row changed - and padFilePut refuses what the application's own code asks to write:

PHP
fragments/replay_1.php HTML
fragments/replay_1.pad Result

<?php

  $statements = [];

  foreach ( [ 'select name from staff', 'check staff where id = 1', 'insert into log values (1)', 'update staff set salary = 0' ] as $sql )
    $statements [] = [ 'sql' => $sql, 'replay' => padReplayWrites ( $sql ) ? 'refused' : 'runs' ];

?>

<table border="1">
  {statements}<tr><td>{$sql}</td><td>{$replay}</td></tr>{/statements}
</table>

select name from staff	runs
check staff where id = 1	runs
insert into log values (1)	refused
update staff set salary = 0	refused