[IanFrelinger]

The trigger was inverted. src/Ashlar.Tests.Kernel's 412 SPEC-006 admission and signing cases run
only in the readiness gate's native lanes, and those lanes are diff-conditional. Both path lists
contained src/Ashlar.Tests.Kernel/** and none of the code that suite tests — so editing the tests
re-ran them, while editing GateStore.cs or AdmissionGate.cs, the code they guard, skipped them.

Adds the kernel project's transitive ProjectReference closure that no entry covered, to both
lists at the same position in the same order:

src/Ashlar.Manifest/**
src/Ashlar.Policies.Dev/**
src/Ashlar.Certification.Contracts/**
src/Ashlar.Analyzers/**

src/Ashlar.Policies/** does not cover src/Ashlar.Policies.Dev/ — the pattern's / after
Policies must consume a /, and the candidate has .Dev there. Confirmed under both matchers.

Ashlar.Analyzers is referenced by Ashlar.Core.Application with OutputItemType="Analyzer" and
ReferenceOutputAssembly="false". It is a build-time analyzer, not code the 412 cases exercise; it
is here because breaking it breaks the kernel suite's build.

Cost is zero, measured

Across the last 40 merged PRs (#683..#631), 20 already set run_heavy=true, and these four entries
flip none of the other 20. Only three of the 40 touched these directories at all — #645 and #662
in Manifest/Admission/, #640 in Policies.Dev/ — and all three already ran heavy via
src/Ashlar.Tests.Infrastructure/**. Heavy runs are ~10-56 min (median 35m07s, n=27) with the
Windows lane on the critical path; light runs median 28s. So this buys coverage on exactly the diffs
that need it without moving the median.

The constraint that makes a correct-looking fix fail

AiPipelineCiRoutingConventionTests:49-61 asserts internalPaths.Should().Equal(push) — identical
globs and ordering — and it is inside required cert-gate. Editing one list, or the two in a
different order, reddens a required check.

So the patch asserts the invariant itself rather than trusting the edit: both lists parsed back out
and compared as sequences (45 = 45, identical), uniqueness, the test's supported-glob shape
(a single trailing /**), and its negative contract that no glob may match README.md,
docs/unrelated-guide.md or src/Unrelated/Nested/Other.cs. Then both matchers were run against
all four target paths and the three negative probes — bash's * crosses / and GitHub's does not,
so they are checked separately.

Records this falsifies

Three claims asserted the absence this PR removes, two written yesterday in #683. Leaving them would
reproduce the defect they describe, one turn later:

• ci/test-ownership.tsv row 58 said Manifest and Policies.Dev were "in neither". Now states the
  routing, and that the wider absent set — 41 directories across all 22 discovered suites — is still
  open.
• docs/specs/SPEC-006-keys-and-signing.md said a change confined to the code under test does not
  re-run the tests that guard it. The other caveat in that paragraph — a skipped lane counts as a
  pass, and the sweep emits no per-project count — is unchanged and still true.
• ci/test-ownership.tsv row 47 stays literally true (src/Ashlar.Analyzers/** does not match
  src/Ashlar.Analyzers.Tests/, verified under both matchers) but now reads as false, so it is
  annotated rather than rewritten.
• docs/CiGateInventory.md:112's core-path prose, which nothing machine-reads.

Verification

• The five affected cert-gate convention tests, devtest container at net8.0:
  114 passed, 0 failed — AiPipelineCiRoutingConventionTests,
  TestOwnershipRunnerConventionTests, CertGateFilterCoverageTests,
  GateSignatureResidualTests, GateStoreAnchorProvenanceConventionTests.
• scripts/knowledge-graph/verify-knowledge-graph-current.py — current. collect_workflows records
  trigger names, not paths, so a path-list edit cannot drift the graph. Checked by running it.
• verify-workflow-context-availability.sh PASS (62 files), verify-workflow-run-interpolation.py
  clean (62), verify-doc-anchors.py 31/31 resolve.
• run-repo-gates.sh --list still 14 against MINIMUM_GATES=11 — no scripts added.
• TSV field integrity: every non-comment row still exactly 4 tab-separated fields.

What this does not fix

ValidationServiceAdapter.cs:248 still computes passed from failures alone, so a discovered
project that selects zero tests still passes; and readiness-summary still counts a skipped lane
as a pass. Both are real and both have blast radius on a required check with enforce_admins=true,
so they are not bundled here.

Worth recording from the investigation: the zero-selection guard would be a no-op ratchet today.
All 22 discovered projects contribute non-zero tests on all three platforms — verified by a full
sweep in the container (5705/5706, 10 skipped, 22 projects) and across 17 sampled master runs, where
the ; no tests selected: suffix has never once been emitted. The detector has never fired because
commit 95f8f41 added it and removed its only trigger (Ashlar.Agents.TestKit) in the same commit.

🤖 Generated with Claude Code