Two tests cover both model helpers: diagnostic paths outside /secrets reach a controlled transport, while paths inside /secrets are rejected before filesystem access. The rejection runner blocks writes even if the guard regresses. Red→green reproduced on b1; fixture transport intentionally fails, and its diagnostic output proves it was started. No model credential or model call is involved.
Validation: b1 250 Python tests passed in 57.516s, zero skips; two focused path tests passed, and fresh strict SSH succeeded using relocated host pins. Exact combined checkout /tmp/messenger-nonsecret-check at 30d687626e4770de693828b2eabbd8c3c6e5feb0. Product 7dd34059a2dce5491ff19bbce4205dbe27bb6c65. No Go/Nix/model rerun for this helper-path-only layer.
Product: #5. This tests PR targets its product branch.