diff --git a/openfut-utas-host/tests/host_test.rs b/openfut-utas-host/tests/host_test.rs
index 6c3c4ad..653bbdd 100644
--- a/openfut-utas-host/tests/host_test.rs
+++ b/openfut-utas-host/tests/host_test.rs
@@ -1347,3 +1347,59 @@ fn duplicate_definition_instances_stay_distinct_through_host() {
         assert_eq!(p["itemData"]["resourceId"], 20801, "shared asset id");
     }
 }
+
+// ── Non-economy routes owned by Rust (no Python fallback, no Core) ──────────────
+
+/// The migrated non-economy static routes are served entirely by Rust: exact
+/// oracle-matching bodies, never proxied to Python, never touching Core. The
+/// security-question route fails closed (400) for an unknown session in Rust —
+/// again without any Python fallback. This is the per-domain no-fallback proof.
+#[test]
+fn non_economy_routes_rust_owned_no_python_no_core() {
+    let core = Arc::new(FakeCore::forbidden()); // any Core call panics
+    let (py_url, rec) = spawn_mock_python();
+    let server = build_server(core, &py_url, None);
+
+    let cases: &[(&str, &str, serde_json::Value)] = &[
+        (
+            "GET",
+            "/ut/game/fifa17/user/accountinfo",
+            serde_json::json!({}),
+        ),
+        (
+            "GET",
+            "/ut/game/fifa17/settings",
+            serde_json::json!({ "configs": [] }),
+        ),
+        (
+            "GET",
+            "/ut/game/fifa17/leaderboards/options",
+            serde_json::json!({}),
+        ),
+        ("PUT", "/ut/game/fifa17/match/reset", serde_json::json!({})),
+    ];
+    for (m, p, want) in cases {
+        let resp = server.handle(m, p, &[], b"");
+        assert_eq!(resp.status, 200, "{m} {p} status");
+        let body: Value = serde_json::from_slice(&resp.body).unwrap();
+        assert_eq!(&body, want, "{m} {p} body");
+    }
+
+    // Security-question with an unknown session fails closed in Rust (never proxied).
+    let resp = server.handle(
+        "GET",
+        "/ut/game/fifa17/phishing/trusteddevice?deviceId=6236375476659cd0f6c780e728774b71",
+        &[("X-UT-SID".into(), "unknown-sid".into())],
+        b"",
+    );
+    assert_eq!(resp.status, 400);
+    let body: Value = serde_json::from_slice(&resp.body).unwrap();
+    assert_eq!(body, serde_json::json!({ "reason": "invalid_session" }));
+
+    // None of the migrated routes reached the Python upstream.
+    assert_eq!(
+        rec.lock().len(),
+        0,
+        "no Python fallback for migrated non-economy routes"
+    );
+}