Disable was removing the confidential config while leaving RA-TLS transport state alive. That left pooled and active attested channels, the loopback listener, the forwarder URL, epoch state, and _CONFIDENTIAL_BLOCK available for later enables, including enables that point at a different service. Call transport teardown after the config disable and make teardown clear all module-owned transport state. The config write remains the authoritative disable; transport cleanup follows it. Also close the related audit gaps: clear stale confidential in-progress UI when polling is cancelled, make the confidential card open setup consistently, drop unread JS helper fields, and cover bucketing across the full reachable RA-TLS reason-code set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>