Every guard, alert, and CI gate gets one deliberate sabotage run to prove it catches, before anyone relies on it. Provisioned is not working.
One project has been bitten twice by mechanisms that sat green and inert: an alert shape that could never fire, and a CI fast path whose fail-safe polarity made a month of inertness invisible. Neither was found by the thing it guarded; both were found by accident.
Even a fail-safe guard needs firing once, or it silently never delivers the benefit it exists for.
Say so in the record. A devlog entry naming the sabotage run — what was broken, what the guard printed, what it printed after the repair — is the difference between a guard someone trusts and a guard someone re-tests from scratch because they can’t tell whether it works.
The general case is DP-015. An unfired guard emits exactly what a guard with nothing to catch emits, so “no findings” is not evidence of a clean tree until something has proved the instrument can speak.