diff --git a/WORKFLOW.md b/WORKFLOW.md
index 5c9b74f..4e6872e 100644
--- a/WORKFLOW.md
+++ b/WORKFLOW.md
@@ -590,8 +590,9 @@ Follow the read-only audit in [`AUDIT.md`](./AUDIT.md) (section 6). It confirms
 the `main`/`develop` rulesets enforce the required merge method + status check + signed commits +
 strict-off, and the repository settings (auto-merge, allowed merge methods) are in place, reporting any
 drift. A missing or incorrect configuration item is a defect (D10). Secret *values* cannot be read
-back, so the audit asserts the names exist (failing if it cannot query them); the GitHub App installation is a
-best-effort check (a precise check needs app-level auth, so it notes rather than fails). The NuGet.org trusted-publishing
+back, so the audit checks that the names exist, reporting a missing name or a failed query as a defect; the
+GitHub App installation is a best-effort check (a precise check needs app-level auth, so it notes rather
+than reports a defect). The NuGet.org trusted-publishing
 policy (D4.7) lives outside GitHub and cannot be checked by `gh api`, so it sits outside AUDIT.md's drift
 report entirely - it is a manual checklist item, verified on NuGet.org (see section 6).
 
@@ -664,5 +665,5 @@ baseline and reports drift without changing anything; that procedure **is** the
 `repo-config/configure.sh [owner/repo] [release|operational]` applies the baseline to a repo (idempotent;
 both arguments optional - the repo defaults to the current one, and the model to the registry lookup,
 falling back to `release` with a warning when no registry is present).
-Secret values cannot be read back, so the audit asserts the names exist (failing if they cannot be queried);
-the App installation is a best-effort check.
+Secret values cannot be read back, so the audit checks that the names exist, reporting a missing name or a
+failed query as a defect; the App installation is a best-effort check.