Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction $\varepsilon$ of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin. We show that it also rests on a confidentiality property: the coin must not interfere with the agent's view before the action commits, at a time the agent chooses. We call this pre-commit noninterference (PNI) and measure its violation by $D_{\mathrm{A}}$, the total-variation distance between the agent's views under the two coin values. PNI is necessary and sufficient for an unbiased certificate against adaptive agents, the worst-case bias is $(1-\varepsilon)D_{\mathrm{A}}$, and no procedure that sees only audited labels can pay less. Leakage composes across steps, a resource shared across episodes opens a channel of computable size, and raising the audit rate cannot restore validity. On a monitor we built, a silent audit changes no output but adds latency that tool timestamps expose, and the agent can enlarge it. A real LLM agent follows an injection that names a visible audit notice (generic, tool, and timing clauses have no effect); over that channel the plain certificate fails on measured labels and, by a post-hoc analysis, in a live run on a pre-registered schedule, while a silent audit restores it. A fresh coin per audited call closes the timing channel; padding only narrows it.
Lightning routing nodes lend their channel balance for a posted fee. Operators' tools move that fee with the balance around a hand-set level, and which part of the fee drives revenue is unclear. We present Trim, which models a channel as a two-sided inventory with costly refills. Its optimal fee is a level, set by demand and replenishment, plus a balance skew, the shadow price of liquidity. The level is first order: no fee rule beats the ceiling demand and replenishment set, and on exactly solved channels the best flat fee comes within $1.6\%$ of the optimum at the median, whereas a level off by a factor of two loses tens of percent. The skew is second-order insurance: it adds at most what the flow-balancing flat fee loses to refused forwards. So the level should be chosen: Trim's rule traces the revenue--success frontier, posts one level on every channel, and adds a skew only where refills stay frequent and costly. On a 2026 snapshot with synthetic payments, no tuned tool beats that frontier by over a few percent, and a skew changes gross revenue by a few percent.