diff --git a/tools/site_audit/audit.mjs b/tools/site_audit/audit.mjs
index de0622c..1400f12 100644
--- a/tools/site_audit/audit.mjs
+++ b/tools/site_audit/audit.mjs
@@ -91,6 +91,12 @@ const VERIFIABLE = new Set(['p1', 'p2', 'p3', 'p4']);
 /**
  * Re-derive the posts from live world.js and fail loudly if the dump drifted.
  * The one guard-rail a hand-typed yard can actually have.
+ *
+ * SPRINT10: world.js stopped being code — createWorld now REQUIRES a site and
+ * throws without one. It reads the site from data/sites/backyard_01.json, which
+ * is exactly the extraction A shipped, so this cross-check now compares the dump
+ * against the DATA's posts (raked in createWorld, no dress needed). loadSite()
+ * itself fetch()es and can't run in node, so read the JSON and hand it over raw.
  */
 async function verifyPosts(site) {
   const THREE = await import('../../web/world/vendor/three.module.js');
@@ -100,7 +106,8 @@ async function verifyPosts(site) {
     speedAt: () => 4, rainAt: () => 0, rainMmPerHour: () => 0,
     gustTelegraph: () => null, setSheltersFromTrees() {}, eventsBetween: () => [],
   };
-  const world = createWorld(new THREE.Scene(), { wind: stub });   // graybox: fine, posts are graybox
+  const siteData = JSON.parse(await readFile(new URL('../../web/world/data/sites/backyard_01.json', import.meta.url), 'utf8'));
+  const world = createWorld(new THREE.Scene(), { wind: stub, site: siteData }); // graybox: fine, posts are raked in createWorld
   const live = new Map(world.anchors.map((a) => [a.id, a.pos]));
   const drift = [];
   for (const a of site.anchors) {