One lesson from Paxos Made Live is that it's useful to have a way to compare replicas' state to verify that they are identical. Doing this periodically helped them discover bugs before they were exposed to applications. Ideally, LogCabin replicas could produce a single checksum value that would cover the entire contents of their state. This state includes: log entries, tombstones, and client responses (for linearizability). These same checksums could also be used to guard against disk corruption, by checking the consistency of servers before they are re-admitted to the cluster.
If the LogCabin servers clean these independently, the set of tombstones and client responses on each replica may be different. In that case, I think only the log entries could be covered in a checksum.
Supposing checksums are verified periodically, what should happen when checksums don't match?