Schedule explicit negative audits asking 'what should…

Schedule explicit negative audits asking 'what should have triggered but didn't' rather than waiting for agents to fire — false negatives don't announce themselves.