I had thought about what to do in case the boundary is invalid, and decided that a crash is the only appropriate thing. The boundary must be 100% reliable in the case of false negatives. From a regulatory and safety perspective, false positives are regrettable but acceptable.