Have /bin/cheritest explicitly test that the failed system-call counter
has increased (well, changed) as a result of triggering a system-call
attempt in a sandbox.
Garbage collect a comment about system-call authorisation.