A feature that reads a mailbox and replies correctly nine times out of ten isn't nine-tenths safe — it's a system waiting for the tenth message. The fix was never "make the model smarter." It was taking authority away from the part of the system that's genuinely bad at knowing what it doesn't know, and giving it to a part of the system that can only do exactly what it's told. Judgment here. Authority there. A validator in between. That's the whole pattern — not just for a calendar, for anything you'd let an agent touch that a stranger could be hurt by.