securesTransport

Encrypted on the wire (honest — see the fabric's own TLS-PSK threat model).

A standing declaration, not a gated obligation — no suite property reads this, and none can (#2304). Proving a fabric is encrypted takes a tap on the wire between the two seams; SeamConformanceSuite holds only the two us.tractat.kuilt.core.Seam handles and has no such access, and a property that inspected bytes at either endpoint would be reading plaintext by construction on a conforming and a lying fabric alike. So this is the SeamConformanceSuite.payloadBudgetGap shape — something written down so it is declared rather than assumed — and the next reader should not go looking for the property that holds a fabric to it.

What holds a fabric to it instead is fabric-owned: a harness that runs the suite over a link that is genuinely encrypted, so the whole suite passing IS the evidence. NwLoopbackConformanceTest is the in-tree example — it declares securesTransport = true because its loopback runs real TLS-PSK, while the fake-radio NwConformanceTest declares false for the same fabric. That split is the honest one, and it is a property of the harness, which is exactly why the suite cannot decide it. false still costs a tracking URL via SeamConformanceSuite.everyFalseCapabilityDeclaresAGap (CapabilityGaps.SECURES_TRANSPORT for the by-design plaintext fabrics), so the declaration is never silent.