A control nobody has watched fail is a belief

The most dangerous state a safeguard can be in is not absent. It is present, broken, and reporting clean. An absent control at least leaves you appropriately nervous.

This site’s confidentiality gate spent time in exactly that state, twice, scanning the wrong files and stripping out the riskiest content before checking it. Every build: green. The fix mattered less than the ritual that followed it: plant a forbidden term in a CSS file, run the build, and watch it die. Then remove the plant and watch it pass.

Now the failure has been observed. The control is no longer a belief about the system. It is a behavior of the system, seen with my own eyes. Every gate I ship gets the same treatment: negative-tested, on purpose, before it is trusted.

The transferable rule: if you have never seen your safeguard fire, you do not know that it can.