diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
index f17dd3e..f203ad4 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs
@@ -238,7 +238,7 @@ public sealed class SecretsStorePathRulesTests
     }
 
     [Fact]
-    public void A_pre_host_container_given_the_content_root_refuses_before_the_store_is_created()
+    public async Task A_pre_host_container_given_the_content_root_refuses_before_the_store_is_created()
     {
         // REGRESSION (found by the HistorianGateway adoption of 0.6.0). An application that expands
         // ${secret:} references before building its host composes this subsystem in a throwaway
@@ -265,13 +265,24 @@ public sealed class SecretsStorePathRulesTests
             services.AddZbSecrets(config, "Secrets", contentRoot);   // the content root, explicitly
             using ServiceProvider provider = services.BuildServiceProvider();
 
-            Assert.Throws<OptionsValidationException>(
-                () => _ = provider.GetRequiredService<SecretsSqliteConnectionFactory>());
+            // Mirror what a pre-host expander actually does: resolve the MIGRATOR and run it.
+            // Resolving the connection factory alone proves nothing here — its constructor never
+            // touches the filesystem, so a "no file created" assertion around it passes whether
+            // the guard works or not. The migration is what creates the database.
+            Exception? thrown = await Record.ExceptionAsync(
+                () => provider.GetRequiredService<SqliteSecretsStoreMigrator>().MigrateAsync(default));
 
-            // The point of the test: refused BEFORE anything touched the filesystem.
+            // ORDER MATTERS, and the obvious order is wrong. Asserting the throw FIRST would mask
+            // the stronger finding: a regression that stops the throw but still creates the store
+            // fails with "no exception was thrown" and never mentions the database sitting at the
+            // rejected path — which IS the defect. "It threw" is the weaker claim, so it is
+            // asserted last. (The defect this test guards was itself "a boot outcome was observed
+            // instead of the artifact being probed", so closing it with an outcome-first assertion
+            // would have repeated the mistake.)
             Assert.False(File.Exists(dbPath), "a rejected path must not be left holding a store file");
             Assert.False(File.Exists(dbPath + "-wal"));
             Assert.False(File.Exists(dbPath + "-shm"));
+            Assert.IsType<OptionsValidationException>(thrown);
         }
         finally
         {