Model fixture helpers required startup diagnostics and thread IDs under /secrets, despite those files containing no credentials. They now require paths outside /secrets while retaining private file permissions. Reproduction documentation uses the relocated state directory and records the eight-file classification and SSH pin consumer. Runtime files were moved with identical hashes; temporary consumers were repointed and strict pinned SSH passed. pear.env stays secret.
This layer follows SATISFIED M6 tests 3c85b0a; no M6 branch changed and no guest configuration changed. Validation details and the linked regression PR follow.
Validation: b1 250 Python tests passed in 57.516s, zero skips; two focused path tests passed, and fresh strict SSH succeeded using relocated host pins. Exact combined checkout /tmp/messenger-nonsecret-check at 30d687626e4770de693828b2eabbd8c3c6e5feb0. Product 7dd34059a2dce5491ff19bbce4205dbe27bb6c65. No Go/Nix/model rerun for this helper-path-only layer.
Tests: #6, targeting this product branch.