Wave one shipped without any confidential-lane test, so the boundary's covenant-critical invariant was the one criterion with no coverage. This is test-harness work rather than a lode. Both cells point at the same reachable local endpoint and differ only by the presence of a confidential provenance block. The control proves the configuration genuinely reaches a model and contacts it exactly once; the invariant proves that adding the block refuses before a single byte leaves, with the endpoint still fully reachable. Without the control, a boundary that refused everything would pass. The assertion is the inference count, not the outcome string -- an outcome-only check cannot tell a working guard from a broken endpoint. The refusal reason is pinned to the attestation family so a refusal caused by some unrelated config error cannot stand in for the guard firing; verified it reports attestation_failed, which is the code the operator ruled blocking today.