Slf4jMaskingFailureSink
The JVM MaskingFailureSink: logs each fail-closed drop via SLF4J with the resource (and field) name only — never the protected value. Resource-level failures (FailReason.NO_PRINCIPAL, FailReason.RESOLVER_ERROR) log once per (call, resource); per-field failures log per field.
Keeping logging here rather than in the engine is what leaves ihawu-core's masking model free of a logging dependency.