diff --git a/internal/catalogue/own_secret_owner_test.go b/internal/catalogue/own_secret_owner_test.go
index c154e476..fba354a0 100644
--- a/internal/catalogue/own_secret_owner_test.go
+++ b/internal/catalogue/own_secret_owner_test.go
@@ -58,10 +58,12 @@ func TestAnOwnSecretsOwnerIsGivenToItsFiles(t *testing.T) {
 	if got := family["owner"]; got != "mesh-mail-send" {
 		t.Fatalf("the family member's owner: %v; want mesh-mail-send", got)
 	}
-	if got := family["mode"]; got != "" && got != nil {
-		// mode is not set by ownedBy; the host applies 0600 to every secret file regardless (ADR 0086). Still,
-		// a mode this test sees must not have been changed by the owner clause.
-		t.Logf("family mode: %v", got)
+	// review round 1, finding 7: asserted, not merely logged. ownedBy never sets "mode", so a sealed secret
+	// file carries none here either — the host applies 0600 to every one regardless (novox/hq ADR 0086) —
+	// and the owner clause must not have added one of its own that could override that.
+	if _, has := family["mode"]; has {
+		t.Fatalf("the family member carries its own mode %v; the owner clause must not set one, so the "+
+			"host's 0600 for every sealed secret file stands", family["mode"])
 	}
 	if plain == nil {
 		t.Fatalf("the module's other own secret was not composed at all: %v", out)