diff --git a/test/test_kb_init_pilot_afd.py b/test/test_kb_init_pilot_afd.py
index a1c7f91d..fcd21e96 100644
--- a/test/test_kb_init_pilot_afd.py
+++ b/test/test_kb_init_pilot_afd.py
@@ -9,7 +9,9 @@
 
 def test_afd_plugin_init_block_is_valid_on_the_real_tree():
     lifecycle = load_registry(adapters_root())["afd-plugin"]
-    assert lifecycle.enabled is False and lifecycle.mode == "shadow"  # init flips it, not this PR
+    # kb init's deepen stage flips `enabled` to true (design §9 PR 3); this test
+    # pins the invariant either side of that flip: shadow, never auto_merge
+    assert lifecycle.mode == "shadow" and not lifecycle.auto_merge
     init = lifecycle.init
     assert init is not None
     assert init.source_roots == ("afd_plugin/",)
diff --git a/test/test_kb_service_core.py b/test/test_kb_service_core.py
index 2af124b4..5fdb7f09 100644
--- a/test/test_kb_service_core.py
+++ b/test/test_kb_service_core.py
@@ -56,7 +56,8 @@ def test_shipped_adapters_register_with_repo_neutral_config():
     assert omni.enabled and omni.mode == "shadow" and not omni.auto_merge
     assert omni.release.trigger == "github_release" and omni.release.auditor == "release_audit.py"
     assert (omni.adapter_dir / omni.release.auditor).is_file()
-    assert registry["afd-plugin"].enabled is False
+    afd = registry["afd-plugin"]   # kb init flips `enabled`; shadow-only is the invariant
+    assert afd.mode == "shadow" and not afd.auto_merge
     assert registry["general"].intake.merged_prs is False