Mira could have reported the touch as an unauthorized contact. She could have traced every hop in the download and filed a million boxes. Instead she logged everything she had done, submitted her evidence, and flagged the unknown certificate. Compliance would do its part. The auditors would follow bureaucratic tangents until they either found the origin or grew tired and closed the loop. She didn’t know which outcome she wanted.