@@ -68,11 +68,11 @@ A parent HelmRelease that hit its wait timeout, uninstalled, and reinstalled is
 
 `hack/select-e2e.sh` walks the `packages/core/platform/sources/*.yaml` dependency graph and runs only the Chainsaw suites affected by a diff. A suite is a directory under `hack/e2e-chainsaw/` containing a `chainsaw-test.yaml`.
 
-- Conservative escalation: edits to `packages/library/`, `packages/core/`, the Go trees (`api/`, `cmd/`, `internal/`, `pkg/`), the codegen under `tools/`, `go.mod`/`go.sum`, top-level `hack/*.sh` helpers, the `hack/e2e-*.bats` the sandbox runs and the `hack/lib/` they source, `hack/*.mk`, `hack/buildkitd.toml`, `hack/e2e-*.yaml`, the shared `hack/e2e-chainsaw/_lib/`, the chainsaw config `hack/e2e-chainsaw/.chainsaw.yaml`, the `Makefile`, or any workflow that runs the suite escalate to the **full suite**. Only `pull-requests.yaml` is executed from the pull request's own head, so escalating on the other three buys generic regression coverage rather than coverage of the edit; the trade and its measured cost are written next to `full_suite_pattern` rather than repeated here. A per-suite edit (any file under `hack/e2e-chainsaw/<app>/`) selects **only** that suite, with one exception: a `*.disabled` file selects nothing, because a parked suite is executed by nothing and editing it cannot regress a test. `hack/e2e-apps/<name>.bats` — the pre-Chainsaw per-app BATS suites — maps the same way, off the basename instead of the directory. What remains in that directory is wired to nothing after the migration, and it is deliberately mapped rather than marked inert: inert would bake the orphan status into the rule and go quietly wrong the day a lane runs those files again, while a name that no suite carries drops out of the intersection and escalates through the backstop exactly as it did when nothing classified it.
+- Conservative escalation: edits to `packages/library/`, `packages/core/`, the Go trees (`api/`, `cmd/`, `internal/`, `pkg/`), the codegen under `tools/`, `go.mod`/`go.sum`, top-level `hack/*.sh` helpers, the `hack/e2e-*.bats` the sandbox runs and the `hack/lib/` they source, `hack/*.mk`, `hack/buildkitd.toml`, `hack/e2e-*.yaml`, the shared `hack/e2e-chainsaw/_lib/`, the chainsaw config `hack/e2e-chainsaw/.chainsaw.yaml`, the `Makefile`, or any workflow that runs the suite escalate to the **full suite**. Only `pull-requests.yaml` is executed from the pull request's own head, so escalating on the other three buys generic regression coverage rather than coverage of the edit; the trade and its measured cost are written next to `full_suite_pattern` rather than repeated here. A per-suite edit (any file under `hack/e2e-chainsaw/<app>/`) selects **only** that suite, with one exception: a `*.disabled` file selects nothing, because a parked suite is executed by nothing and editing it cannot regress a test. `hack/e2e-apps/<name>.bats` — the pre-Chainsaw per-app BATS suites — maps the same way, off the basename instead of the directory. What remains in that directory is wired to nothing after the migration, and it is deliberately mapped rather than marked inert: inert would bake the orphan status into the rule and go quietly wrong the day a lane runs those files again. The basename is membership-tested against the suite list on the spot, and a name no suite carries escalates there and then, naming the file. Deferring that to the final intersection instead would leave the verdict to the rest of the diff — alone the selection empties and the backstop escalates, but beside any path that contributed a suite the escalation disappears and the run narrows to that suite in silence, which is the merge-before-escalate shape #3330 removed from the graph walk. Anything else under `hack/e2e-apps/` — a nested path, a non-`.bats` file — is shared material for those suites the way `hack/e2e-chainsaw/_lib/` is for the Chainsaw ones, and escalates for the same reason.
 - **Every path is classified, and an unclassified one escalates.** The selector has three selection outcomes — full suite, a scoped set, or nothing — and each is reached by an explicit rule; the fourth outcome in the bullet below is not a selection but a refusal to produce one. Several rules produce the empty one, which is worth knowing before reading an empty selection as "the inert list matched": documentation, dashboards and `*.md` are dropped first wherever they live, a `*.disabled` Chainsaw suite and a `examples/backups/<app>/` edit whose app has no suite are dropped where chainsaw and backup-example paths are matched, and `inert_config_pattern` covers repo meta, agent config, `hack/testdata/`, the helm-unittest fixture charts under `packages/tests/`, every `.gitattributes` (all of them are `linguist-generated` markers, which reach no build, chart or test) and the top-level `hack/*.bats` that are not `hack/e2e-*.bats`. That last one is the unit lane, and the root `Makefile` is the authority on the split: `BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))` keeps 60 files for `make unit-tests` while `packages/core/testing`'s recipes run only the three it filters out, so the sandbox never executes one of the 60 and no Chainsaw suite can regress from an edit to one. Being inert here does not leave them untested: the `unit-tests` job is gated on the `plan` job's `code` output, which `pull-requests.yaml` computes as "any changed path outside `docs/`" and never from `select-e2e.sh`, so a bats-only pull request still runs the whole unit lane — plus install and the OpenAPI tests, since the `e2e` job also reads `code` rather than the selection. `full_suite_pattern` covers shared build inputs and the e2e harness, and the graph lookup handles `packages/(apps|system|extra)/`. A path matching none of them escalates to the full suite and logs why, because both lanes read an empty selection as "skip Chainsaw" and then post `E2E Tests` green — so a silent default is a green gate with nothing tested (#3392). When that escalation fires for something genuinely inert, add it to `inert_config_pattern`; do not relax the fall-through. The escalation list and the inert list are checked in that order, so a specific escalation beats a broad inert directory.
 - **Coverage is decided per changed path.** A path that resolves through the graph but reaches no runnable suite is covered by nothing, so it forces the full run on its own account, whatever the rest of the diff selected. Reading that off the merged selection instead let any other changed path contributing a suite name swallow the escalation, with nothing in the output to record that it happened: change a platform component, adjust the Chainsaw test beside it, and the component's escalation disappeared behind that one suite (#3330). The unit is the path rather than the source, because one path can belong to several PackageSources — `system/postgres-operator` belongs to two, one of which reaches no suite — and deciding per source would escalate on that half and run everything for every change to it.
 - **There is a fourth outcome, and it is a failed step rather than a selection.** It fires when the suite list itself is unavailable: `find` cannot list `hack/e2e-chainsaw/`, or that directory holds no `chainsaw-test.yaml`. There is no fallback left to take, because escalating would print an empty list and both lanes read an empty selection as "skip Chainsaw" before posting `E2E Tests` green — the outcome meaning "run everything" would deliver a run of nothing. So the selector names what broke on stderr and exits non-zero; both lanes run the step under `bash -e`, so the job fails and the required check goes red. A red `Select E2E tests` step is a real signal, not a flake: read its stderr line before rerunning. A `yq` failure is deliberately not in this class — what is missing there is the dependency graph, not the suite list, so the selector still has a safe answer and escalates to the full suite. That is conservative but quiet: the only sign is one stderr line inside a step that passes, so a selector running blind on every PR looks exactly like a project that escalates a lot.
-- **Every escalation names its cause on stderr.** "Run everything" is the same list of suite names whichever rule produced it, so a reason line is the only thing that distinguishes the seven branches that can reach it, and without one the answer to "why did this pull request run the whole suite" has to be re-derived by hand from the diff. Four of the seven used to be silent — the shared `hack/e2e-chainsaw/_lib/` and `.chainsaw.yaml` case, the `full_suite_pattern` match, a `packages/` path no PackageSource claims, and the empty-selection backstop — and `full_suite_pattern` is the commonest cause of a full run by a wide margin, so the usual answer was the one the log never carried. Each line names the path or the sources that caused it, and a unit test asserts each message, because a reason that regresses to silence changes no selection and is invisible to every other test. The lines go to **stderr** and must stay there: stdout is the suite list and both lanes parse it, so a reason line on stdout would be read as a suite name.
+- **Every escalation names its cause on stderr.** "Run everything" is the same list of suite names whichever rule produced it, so a reason line is the only thing that distinguishes the branches that can reach it, and without one the answer to "why did this pull request run the whole suite" has to be re-derived by hand from the diff. Four of them used to be silent — the shared `hack/e2e-chainsaw/_lib/` and `.chainsaw.yaml` case, the `full_suite_pattern` match, a `packages/` path no PackageSource claims, and the empty-selection backstop — and `full_suite_pattern` is the commonest cause of a full run by a wide margin, so the usual answer was the one the log never carried. Each line names the path or the sources that caused it, and a unit test asserts each message, because a reason that regresses to silence changes no selection and is invisible to every other test. The lines go to **stderr** and must stay there: stdout is the suite list and both lanes parse it, so a reason line on stdout would be read as a suite name.
 - **The one path the fall-through cannot catch is a new e2e workflow.** `inert_config_pattern` makes `.github/` inert as a directory, and the workflows that run the suite are exempted from it by name in `full_suite_pattern`. A workflow added under `.github/workflows/` therefore reads as inert until someone adds it to that enumeration, and the fall-through never sees it. That is why the list carries a `rg -l test-chainsaw .github/workflows/` reminder: the enumeration is the guard, not a convenience.
 - The `full-e2e` PR label forces the whole suite.
 - The selection is passed to `make test-chainsaw CHAINSAW_SUITES="<names>"`, which runs `chainsaw test <names>` from `hack/e2e-chainsaw/` (empty = the whole suite).
 
@@ -45,10 +45,12 @@
 # rather than a courtesy: the answer "run everything" is the same 21 suite names
 # whichever rule produced it, so without a reason line the only way to learn why
 # a pull request ran the whole suite is to re-derive the selection by hand. Four
-# of the seven were silent, full_suite_pattern — the commonest cause by a wide
-# margin — among them, which made the usual answer the one the log never had. A
-# test asserts each line, because a reason that regresses to silence changes no
-# selection and so is invisible to every other test here.
+# of them were silent before this rule, full_suite_pattern — the commonest cause
+# by a wide margin — among them, which made the usual answer the one the log
+# never had. A test asserts each line, because a reason that regresses to silence
+# changes no selection and so is invisible to every other test here. Deliberately
+# stated without a count: the number of escalating branches moves whenever a rule
+# is added, and a comment carrying a stale one reads as authoritative.
 #
 # The lines go to stderr, never stdout. stdout is the suite list and both lanes
 # parse it, so a reason line there would be read as a suite name.
@@ -312,7 +314,7 @@ while IFS= read -r file || [ -n "$file" ]; do
       selected_apps="$selected_apps $app"
       trigger_any=1
       continue ;;
-    hack/e2e-apps/*.bats)
+    hack/e2e-apps/*)
       # The pre-Chainsaw per-app BATS suites. One file per app, named after it,
       # so the suite name comes off the basename exactly as the rule above takes
       # it off the directory.
@@ -323,14 +325,34 @@ while IFS= read -r file || [ -n "$file" ]; do
       # mapping is correct either way — a file named after an app selects that
       # app's suite whether or not anything currently executes it.
       #
-      # A basename that names no suite (the monitoring-oidc-* pair left here has
-      # no Chainsaw suite of its own) is dropped by intersect_suites downstream,
-      # and if it was the only selection the backstop escalates and says so. That
-      # is the same outcome the unclassified fall-through gave these paths before,
-      # so nothing is lost by mapping optimistically.
-      app=$(echo "$file" | sed -nE 's,^hack/e2e-apps/(.+)\.bats$,\1,p')
-      selected_apps="$selected_apps $app"
-      trigger_any=1
+      # The membership test is what makes this per-path, and it is not optional.
+      # Adding an unmatched name to selected_apps and letting the final
+      # intersection drop it leaves the verdict to the REST of the diff: alone it
+      # empties the selection and the backstop escalates, but beside any path that
+      # contributed a suite the escalation vanishes and the run narrows to that
+      # suite with nothing on stderr. That is the merge-before-escalate shape
+      # #3330 removed from the graph walk, and it applies here for the same
+      # reason — coverage is a property of the changed path.
+      #
+      # `[^/]+` rather than `.+`: POSIX case matches `/` with `*`, so this arm
+      # also sees nested paths, and an unanchored capture would turn
+      # hack/e2e-apps/fixtures/postgres.bats into the "suite" fixtures/postgres.
+      # Nothing nested exists here today; whatever appears would be shared
+      # material for these suites the way hack/e2e-chainsaw/_lib/ is for the
+      # Chainsaw ones, so it escalates for the same reason rather than being
+      # guessed at. A non-.bats file directly in the directory lands here too and
+      # is treated the same way.
+      app=$(echo "$file" | sed -nE 's,^hack/e2e-apps/([^/]+)\.bats$,\1,p')
+      if [ -z "$app" ]; then
+        echo "select-e2e: '$file' is not a per-app suite file (hack/e2e-apps/<name>.bats), so it is shared material for all of them — escalating to the full suite" >&2
+        trigger_full=1
+      elif echo "$all_apps" | grep -Fxq "$app"; then
+        selected_apps="$selected_apps $app"
+        trigger_any=1
+      else
+        echo "select-e2e: '$file' names no runnable suite ('$app') — escalating to the full suite" >&2
+        trigger_full=1
+      fi
       continue ;;
     examples/backups/*/*)
       # The etcd, postgres, mariadb and clickhouse backup round-trip tests
@@ -472,12 +494,12 @@ done
 final_apps=$(intersect_suites "$group_suites $selected_apps")
 
 # Backstop. Every graph path above either escalates or contributes a suite that
-# exists, so what still reaches this is a directly-selected name that is not a
-# suite: a per-suite edit naming a directory that holds no chainsaw-test.yaml —
-# shared material beside _lib/, or a suite nested deeper than the depth-2 scan
-# looks — or a hack/e2e-apps/<name>.bats whose <name> no suite carries.
-# Selecting nothing for those would skip E2E outright, so failing towards the
-# full suite is the only safe way to be wrong here.
+# exists, and both rules that select a suite by name — the per-app BATS one and
+# the examples/backups/<app>/ one — membership-test it first, so what still
+# reaches this is a per-suite Chainsaw edit naming a directory that holds no
+# chainsaw-test.yaml: shared material beside _lib/, or a suite nested deeper than
+# the depth-2 scan looks. Selecting nothing for those would skip E2E outright, so
+# failing towards the full suite is the only safe way to be wrong here.
 #
 # group_suites is empty whenever this fires — every group either escalated above
 # or contributed a suite that exists — so the names worth naming are the