The Replica (contract code) is the core contract deployed on all chains that wish to receive inbound messages. It serves as the "inbox" for all messages sent from a specific Home contract. For example, the uni-directional channel from Ethereum to Moonbeam is generated by deploying a Home on Ethereum, and an Ethereum Replica on Moonbeam.
Before accepting an update, a Replica places it into a queue of pending updates. Each update must wait for some time parameter (the optimistic dispute window) before being accepted. While a Replica cannot know that an update is certainly valid, the dispute window guarantees that fraud is publicly visible on the Home before being accepted by the Replica.
In other words, the security guarantee of the system is that all fraud may be detected by any participant and published via a proof on-chain during the window to react. Therefore updates that are not flagged by Watchers are sufficiently trustworthy for the Replica to accept.