diff --git a/test/cli.sh b/test/cli.sh
index 3cbf64f..6c2883b 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -3289,6 +3289,29 @@ cibox_src_matches_install() {
 }
 check "ci-box: CLI_SRC is the path its install.sh installs" 0 "" cibox_src_matches_install
 
+# codex/kimi on !137: the two wiring lines this change exists to add could be
+# deleted tomorrow and the suite stayed 786/786 on any host without a real
+# Forgejo runner — hermetic today, unpinned. #136's task list names the guard
+# verbatim: "a check that fails if either group can see host state".
+#
+# These assert on the SUITE's own helpers, not the production knobs — the knobs
+# are already covered above. What must go red is a deletion on the test side,
+# because that is the regression that silently reintroduces host dependence.
+undo_is_sealed() {
+  sed -n '/^undo() {/,/^}/p' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
+}
+cibox_run_is_sealed() {
+  sed -n '/^cibox_run() {/,/^}/p' "$0" | grep -q 'CIBOX_BIN='
+}
+check "hermetic: undo() seals the Forgejo-runner host scan" 0 "" undo_is_sealed
+check "hermetic: cibox_run() seals the real /usr/local/bin lookup" 0 "" cibox_run_is_sealed
+# The failed-logout check builds its own env rather than calling undo(), so it
+# needs the same seal — and it is the one that was missed first time round.
+inline_undo_is_sealed() {
+  grep -A 4 'failed logout is loud' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
+}
+check "hermetic: the hand-rolled undo invocation is sealed too" 0 "" inline_undo_is_sealed
+
 # Registration holds a credential, so it must NOT be in the definition: a
 # tenant install is creds-free by contract — box auto-runs it at mint, holding
 # nothing. Registration is the operator's separate, out-loud act.