@@ -137,6 +137,13 @@ jobs:
           python scripts/generate.py config/variants/canbus-plattform.json >/dev/null
           bash tests/test-apply-parity.sh
 
+      - name: 🧪 Apply guard test
+        # Every guard in apply-lib.sh is a negative - "this must NOT
+        # happen" - and negatives rot silently: a refactor that drops a
+        # condition passes every other test in the suite, because nothing
+        # it does is wrong, it just stops declining.
+        run: bash tests/test-apply-guards.sh
+
       - name: 🧪 Apply idempotence test
         # Applies every module twice against a scratch root in device
         # context and asserts the second run changes nothing and queues no
 
@@ -41,7 +41,7 @@ render: ## resolve env vars + render generated module files
 	$(PY) scripts/generate.py $(CONFIG) $(if $(ENV_FILE),--env-file $(ENV_FILE),)
 
 .PHONY: test
-test: test-selfupdate test-parity test-idempotence ## run all tests (needs docker)
+test: test-selfupdate test-parity test-idempotence test-guards ## run all tests (needs docker)
 
 .PHONY: test-selfupdate
 test-selfupdate: ## exercise `bgrpiimage-setup update --self`
@@ -55,6 +55,10 @@ test-parity: render ## assert apply.sh still produces what the chroot scripts di
 test-idempotence: render ## assert applying a release twice is a no-op
 	bash tests/test-apply-idempotence.sh
 
+.PHONY: test-guards
+test-guards: ## assert the apply-lib guards actually refuse
+	bash tests/test-apply-guards.sh
+
 .PHONY: bootstrap
 bootstrap: ## clone/update CustomPiOS into ./CustomPiOS
 	bash scripts/bootstrap.sh
 
@@ -1762,6 +1762,51 @@ def _semantic_validate(cfg: dict[str, Any]) -> None:
         )
 
 
+def _validate_apply_contract(cfg: dict[str, Any]) -> list[str]:
+    """Assert every rendered payload file is actually installed by its module.
+
+    The failure this catches is quiet and expensive: a renderer starts
+    emitting a file, nobody adds it to apply.sh, and the file rides along in
+    /opt/bgrpiimage on every device without ever reaching the path that makes
+    it do something. Nothing errors. The setting simply has no effect, and the
+    symptom shows up weeks later as "we shipped that fix, why is the bus still
+    dead" - which is exactly how the SamplePoint and TransmitQueueLength bugs
+    presented before them.
+
+    Deliberately a textual reference check rather than a manifest. A manifest
+    would be a second description of the same thing, kept in sync by hand -
+    the duplication that produced the CAN constant drift between generate.py
+    and bgrpiimage-setup. Here the apply script stays the single description,
+    and this only asserts it mentions everything the renderer produced.
+    """
+    problems: list[str] = []
+    for module in ACTIVE_MODULES:
+        if not _module_enabled(module, cfg):
+            continue
+        apply_sh = MODULES_DIR / module / "apply.sh"
+        if not apply_sh.exists():
+            continue
+        body = apply_sh.read_text(encoding="utf-8")
+        gen = MODULES_DIR / module / "filesystem" / "root" / "opt" / "bgrpiimage" / module
+        if not gen.is_dir():
+            continue
+        for path in sorted(gen.rglob("*")):
+            if not path.is_file():
+                continue
+            rel = path.relative_to(gen)
+            if rel.as_posix() == "apply.sh":
+                continue  # staged by the generator, not consumed by the script
+            # A file may be named outright, or covered by its directory when
+            # the module mirrors a whole tree with bg_install_tree.
+            names = {rel.as_posix(), path.name}
+            parent = rel.parent.as_posix()
+            if parent != ".":
+                names.add(parent)
+            if not any(n in body for n in names):
+                problems.append(f"{module}: renders {rel.as_posix()} but apply.sh never mentions it")
+    return problems
+
+
 def _window_minutes(start_hhmm: str, end_hhmm: str) -> int:
     """Minutes between two HH:MM timestamps, wrapping past midnight if needed."""
     def to_min(s: str) -> int:
@@ -1988,6 +2033,19 @@ def main() -> int:
 
     render_variant_config(resolved)
     console.print(table)
+
+    # After rendering, not before: the check compares what was actually
+    # produced against what the apply scripts reference.
+    contract_problems = _validate_apply_contract(resolved)
+    if contract_problems:
+        _error_panel(
+            "apply contract violated",
+            "\n".join(contract_problems),
+            "a rendered file that no apply.sh installs reaches devices but "
+            "never takes effect - add it to the module's apply.sh, or stop "
+            "rendering it",
+        )
+        return 1
     console.print(
         f"  [green]{total}[/] artifact{'s' if total != 1 else ''} written to "
         f"[dim]src/modules/*/filesystem/root/[/]\n"
 
@@ -116,6 +116,58 @@ bg_intent() {
     printf '%s\n' "$line" >> "$BGRPI_INTENTS"
 }
 
+# ---------------------------------------------------------------------------
+# What an update may never write
+# ---------------------------------------------------------------------------
+# Enforced here, in the one function that writes, rather than trusted to each
+# module. A denylist nine scripts are supposed to respect is a code-review
+# convention and will be violated within two releases; a denylist the writer
+# enforces is a property of the system.
+#
+# DEVICE CONTEXT ONLY. Several of these are written legitimately at image
+# build time - /etc/hostname and /etc/hosts are exactly what bgrpiimage-base
+# is for. The list is about what an UPDATE to a configured, deployed machine
+# may touch, and the answer for all of it is "not this".
+#
+# Three kinds of entry:
+#   identity and access    shadow/passwd/sudoers/pam - the only two ways onto
+#                          these boxes are sudo and su, and they are each
+#                          other's only fallback. An update that breaks both
+#                          is a truck roll with an rpiboot jumper.
+#   operator-owned state   the 05- overrides this project's own helper writes,
+#                          wpa_supplicant PSKs, rfkill saved state, static
+#                          resolv.conf, hostname - site data, not platform.
+#   boot and storage       cmdline.txt and fstab, where one typo is an
+#                          unbootable device rather than a failed service.
+BGRPI_DENY_GLOBS=(
+    '/etc/shadow' '/etc/passwd' '/etc/group' '/etc/gshadow'
+    '/etc/subuid' '/etc/subgid'
+    '/etc/sudoers' '/etc/sudoers.d/*'
+    '/etc/pam.d/*'
+    '/etc/ssh/ssh_host_*'
+    '/home/*' '/root/*'
+    '/etc/hostname' '/etc/hosts'
+    '/etc/resolv.conf'
+    '/etc/wpa_supplicant/*'
+    '/var/lib/systemd/rfkill/*'
+    '/etc/systemd/network/05-bgrpiimage-*'
+    '/etc/docker/daemon.json'
+    '/boot/firmware/cmdline.txt'
+    '/etc/fstab' '/etc/crypttab'
+    '/etc/apt/sources.list' '/etc/apt/sources.list.d/*' '/etc/apt/keyrings/*'
+    '/etc/machine-id'
+)
+
+bg_denied() {
+    local dest="$1" g
+    bg_is_image && return 1
+    for g in "${BGRPI_DENY_GLOBS[@]}"; do
+        # shellcheck disable=SC2053  # glob match on the right is the point
+        [[ "$dest" == $g ]] && return 0
+    done
+    return 1
+}
+
 # ---------------------------------------------------------------------------
 # Writing
 # ---------------------------------------------------------------------------
@@ -131,6 +183,9 @@ bg_install() {
     BGRPI_LAST_CHANGED=0
 
     [[ -r "$src" ]] || bg_die "bg_install: source not readable: $src"
+    if bg_denied "$dest"; then
+        bg_die "refusing to write $dest on a running system - see BGRPI_DENY_GLOBS"
+    fi
 
     if [[ -f "$target" ]] && [[ "$(_bg_sha "$src")" == "$(_bg_sha "$target")" ]]; then
         # Content matches; still assert the mode, because a wrong mode is a
 
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Asserts the guards in apply-lib.sh actually refuse.
+#
+# These are the guards that stand between an update and a truck roll, and
+# every one of them is a negative: "this must NOT happen". Negatives rot
+# silently - a refactor that drops a condition passes every other test in the
+# suite, because nothing it does is wrong, it just stops declining. So they
+# get their own assertions.
+#
+#   bash tests/test-apply-guards.sh      # or: make test-guards
+set -uo pipefail
+
+if [ -z "${BGRPI_TEST_INNER:-}" ]; then
+    root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+    command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
+    mount="$root"
+    case "$(uname -s)" in
+        MINGW*|MSYS*|CYGWIN*) mount=$(cygpath -w "$root"); export MSYS_NO_PATHCONV=1 ;;
+    esac
+    exec docker run --rm -e BGRPI_TEST_INNER=1 \
+        -v "${mount}:/repo:ro" debian:trixie-slim \
+        bash /repo/tests/test-apply-guards.sh
+fi
+
+PASS=0; FAIL=0
+ok()  { echo "  PASS  $*"; PASS=$((PASS+1)); }
+bad() { echo "  FAIL  $*"; FAIL=$((FAIL+1)); }
+
+LIB=/repo/src/modules/bgrpiimage-common/apply-lib.sh
+mkdir -p /scratch/etc /stub
+printf 'payload\n' > /src.txt
+for c in systemctl networkctl udevadm; do
+    printf '#!/bin/sh\nexit 0\n' > "/stub/$c"; chmod +x "/stub/$c"
+done
+export PATH="/stub:$PATH"
+
+# Run one bg_install in a subshell and report its exit status.
+try_install() { # ctx dest
+    ( export BGRPI_CTX="$1" BGRPI_ROOT=/scratch BGRPI_INTENTS=/i.txt
+      # shellcheck disable=SC1090
+      . "$LIB"
+      bg_install /src.txt "$2" 0644 ) >/dev/null 2>&1
+}
+
+echo "=== denylist: refused on a device, allowed while building an image ==="
+for p in /etc/shadow /etc/passwd /etc/sudoers.d/010-bgrpiimage-admin \
+         /etc/pam.d/su /etc/ssh/ssh_host_rsa_key /etc/hostname /etc/hosts \
+         /etc/resolv.conf /etc/wpa_supplicant/wpa_supplicant-wlan0.conf \
+         /var/lib/systemd/rfkill/0:wlan \
+         /etc/systemd/network/05-bgrpiimage-can0.network \
+         /etc/docker/daemon.json /boot/firmware/cmdline.txt /etc/fstab \
+         /etc/apt/sources.list.d/docker.list /etc/machine-id; do
+    if try_install device "$p"; then bad "device write to $p was ALLOWED"; else ok "device refuses $p"; fi
+done
+
+echo "=== the same paths are legitimate at build time ==="
+for p in /etc/hostname /etc/hosts; do
+    if try_install image "$p"; then ok "image may write $p"; else bad "image write to $p was refused"; fi
+done
+
+echo "=== paths this project owns stay writable on a device ==="
+for p in /etc/systemd/network/40-can0.network /etc/systemd/network/70-can0.link \
+         /etc/apt/apt.conf.d/50unattended-upgrades /etc/issue \
+         /etc/update-motd.d/10-bgrpiimage /etc/bgrpiimage-release; do
+    if try_install device "$p"; then ok "device may write $p"; else bad "device write to $p was refused"; fi
+done
+
+echo "=== unit masking is build-only ==="
+mask_rc() { # ctx -> "refused" | "did it"
+    ( export BGRPI_CTX="$1" BGRPI_ROOT=/scratch BGRPI_INTENTS=/i.txt
+      # shellcheck disable=SC1090
+      . "$LIB"
+      bg_unit_mask NetworkManager 2>&1 ) | grep -q 'refusing to mask' && echo refused || echo did
+}
+[ "$(mask_rc device)" = "refused" ] && ok "device refuses to mask a unit" || bad "device masked a unit"
+[ "$(mask_rc image)"  = "did" ]     && ok "image may mask a unit"        || bad "image refused to mask"
+
+echo "=== dry run writes nothing ==="
+rm -rf /scratch; mkdir -p /scratch
+( export BGRPI_CTX=device BGRPI_ROOT=/scratch BGRPI_DRY_RUN=1 BGRPI_INTENTS=/i.txt
+  # shellcheck disable=SC1090
+  . "$LIB"
+  bg_install /src.txt /etc/issue 0644 ) >/dev/null 2>&1
+if [ -e /scratch/etc/issue ]; then bad "dry run created a file"; else ok "dry run created nothing"; fi
+
+echo
+echo "================ $PASS passed, $FAIL failed ================"
+[ "$FAIL" -eq 0 ]