ContainmentBench: taint-only enforcement completes 16.4% of authorized workflows, a trusted ledger reaches 85.7%.

arXiv 2607.23999 argues terminal attack/policy labels hide what actually happens after an injection lands, and measures endpoint compliance, logged propagation, recovery and authorized-action completion separately. In a pre-specified 17,640-rollout study, all 600 matched active-tainted pairs comparing taint-only versus intent-aware enforcement produced identical zero committed-harm outcomes, yet 73.5% differed in logged trajectory or retained utility. Taint-only completed 0.1642 of authorized tainted workflows; trusted-ledger 0.8567; a strong tool-boundary baseline 0.9233. Synthetic and single-model, but "no harm committed" is clearly not a sufficient statistic. (arXiv 2607.23999)