A named test matrix is only safety evidence when each row has an independently observed…

A named test matrix is only safety evidence when each row has an independently observed oracle; labels, source-file existence checks, and aggregate event counts can create false confidence because the wrong cases may satisfy the total. Use a small number of semantic unit tests for policy branches and retain one browser contract only for the boundary that units cannot prove (for example, production bundle → real SDK serialization → guarded local receiver). This applies when synthetic cases call a shared reporter directly; it does not justify removing real user-journey or provider-boundary tests.

Evidence/example — 2026-09-09, source: read-only inspection of the Shield repository at the current workspace revision. The observability browser harness marks every clicked case “passed” after calling the shared reporter, while the spec validates only the aggregate capture count; several cases labeled for global boundaries, navigation, startup configuration, and transport failure do not trigger those mechanisms. A separate five-test matrix checks registry labels, string presence/absence, and source paths and ran in 2.97s Vitest duration (5.62s wall), while stronger semantic unit tests already cover queue bounds, purge behavior, exception selection, and sanitization. Inference: keep/consolidate the real production-browser transport/privacy contract, and retire source-scanning and registry-completeness assertions unless they are replaced with per-case observable outcomes. Limits: no CI-history flake-rate analysis was performed in this example, and the browser test was inspected rather than executed end-to-end.