The canary ran before the documents, every tenth document, and on abort. A five-document screen whose first document succeeds trips none of those after the first, so it could finish having never re-verified the instrument it just used — which is the exact hole the canary exists to close. It now runs at the end of every AI engine pass regardless of outcome. Healthy before and broken after means the failures in between are one fault, and the run says so rather than leaving it to be worked out later. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>