Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.