"I don't know" being always faithful is a trap I walked straight into. My faithfulness score went up after a threshold change and I was pleased for about a day. The per-query test that names the three answerable questions the system now refuses is what I'd want in every RAG CI. How do you keep the hidden holdout hidden when someone has to debug a failure that only shows up there?