@@ -466,7 +466,9 @@ when landing it, satisfy the gate where one exists.
 - **A gate that stops running is worse than no gate.** Gate: the gate manifest
   (`scripts/gate/`, #1429). every shell block a qualifying lane reaches — a `run:` step, or a value
   passed to an action input the action executes — is either `pnpm gate <check-id>` or inventoried in
-  `scripts/gate/declarations.ts`, so the workflow→check mapping is a shape check
+  `scripts/gate/declarations.ts`. Which inputs an action executes is read for a local composite and
+  declared per pinned sha for a third-party one, so an undeclared action is a failure rather than an
+  assumption that it runs nothing. The workflow→check mapping is a shape check
   rather than an interpretation of shell, and a gate that is not in the registry
   (`scripts/check-affected/checks.ts`) cannot run at all — the failure
   mode is a red build, not an invisible one. `check:gate-manifest` fails when a registered check
 
@@ -218,26 +218,31 @@ strings, and four suites (`check:tmpdir-leaks`, its model tests, `test:fixture-c
 
 The rule: **every shell block a qualifying lane reaches is either `pnpm gate <check-id>`
 or listed in `NON_GATE_STEPS`.** A shell block is a `run:` step — in a workflow or in a local
-composite action — or a value passed to an action input that the action interpolates into a
-`run:`. That second kind matters because `setup-apple-runner-build` runs
-`${{ inputs.build-command }}`: its own step digest is constant, so the command is really written
-at the call site, and the caller's value is held to the rule instead. Nothing inspects what a
-command does. That is deliberate
+composite action — or a value passed to an action input that the action executes. That second
+kind matters because `setup-apple-runner-build` runs `${{ inputs.build-command }}`: its own step
+digest is constant, so the command is really written at the call site, and the caller's value is
+held to the rule instead. Which inputs an action executes is *read* for a local composite (any
+input it interpolates into a `run:` block) and *declared* for a third-party one, per pinned sha,
+in `EXTERNAL_ACTIONS` — an action nothing declares fails the audit rather than being assumed
+inert. The Android smoke suite runs entirely inside `android-emulator-runner`'s `script:` input,
+so that is not a hypothetical surface. Nothing inspects what a command does. That is deliberate
 and was learned the hard way: a content-based classifier was defeated by `pnpm exec`, then
 by `pnpm exec --` and `npx --yes`, then by `node -e 'import("./scripts/…")'` — and after
 those, `eval`, heredocs and base64 remain. "Does this text run project code?" is not
 answerable from text, so the question is not asked. A step is allowed because of its
 shape; everything else is written down by a human, which is the only boundary an unknown
 spelling cannot walk through.
 
-The price is a long inventory (104 entries today, keyed on the file that declares them, so a
+The price is a long inventory (109 entries today, keyed on the file that declares them, so a
 composite action shared by eight lanes is listed once — but an executed input is listed per call
 site, because a new caller of the same action is a new command to review). That is the census of
 everything CI does outside the runner, and it fails in both directions — an unlisted step fails as
 a bypass, a listed step whose body is edited fails as both, since entries bind the step's digest
 (`run` plus `env`/`shell`/`working-directory`) rather than its name. Lane-level `env:` is
 fingerprinted the same way in `LANE_ENVIRONMENTS`, and the two execution surfaces the loader does
-not read — `defaults.run` and reusable-workflow jobs — fail closed rather than being ignored.
+not read — `defaults.run` and reusable-workflow jobs — fail closed rather than being ignored. A
+composite-action cycle raises rather than truncating: the depth cutoff it replaces returned an
+empty step list, which every assertion downstream would read as "this action executes nothing".
 Every gate is a `CheckId` in the registry (`scripts/check-affected/checks.ts`) — the same universe
 the affected-selector uses — so the workflow→check mapping is a token scan for `pnpm gate <id>`
 rather than an interpretation of shell. That is what makes a new gate impossible to hide: an
 
@@ -130,7 +130,7 @@
     "check:affected:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/check-affected/model.test.ts scripts/check-affected/platform-packages.test.ts scripts/check-affected/run.test.ts",
     "gate": "node --experimental-strip-types scripts/gate/run.ts",
     "check:gate-manifest": "node --experimental-strip-types scripts/gate/check.ts",
-    "check:gate-manifest:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/gate/model.test.ts scripts/gate/audit.test.ts scripts/gate/run.test.ts",
+    "check:gate-manifest:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/gate/*.test.ts",
     "check:coverage-changed": "node --experimental-strip-types scripts/coverage-changed/run.ts",
     "check:coverage-changed:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/coverage-changed/model.test.ts scripts/coverage-changed/run.test.ts",
     "check:layering": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/layering/model.test.ts scripts/layering/zone-policy.test.ts scripts/layering/daemon-modularity.test.ts scripts/layering/package-boundaries.test.ts scripts/layering/platform-package-policy.test.ts scripts/layering/platform-package-repository.test.ts scripts/layering/platform-package-source-policy.test.ts scripts/layering/device-inventory-cutover-policy.test.ts scripts/layering/logs-runtime-cutover-policy.test.ts scripts/layering/network-runtime-cutover-policy.test.ts scripts/layering/record-runtime-cutover-policy.test.ts scripts/layering/contracts-implementation-policy.test.ts scripts/layering/facade-exports.test.ts scripts/layering/bin-alias-fast-path.test.ts && node --experimental-strip-types scripts/layering/check.ts",
 
@@ -0,0 +1,174 @@
+// Assertion group two: is every registered check actually RUN by a lane a PR would start?
+//
+// Split from audit.test.ts, which asserts the other half — that nothing runs outside a
+// gate. The two use different machinery (a mutated model here, planted YAML through the
+// real loader there), which is the seam; `scripts/layering/` names its test files after
+// the claim they assert for the same reason.
+//
+// Every case mutates the REAL model and asserts the audit goes red for the right reason.
+// #1714's predecessor had 75 unit tests over home-grown parsers, and the two holes that
+// mattered — a suite outside the naming convention, and category samples naming files no
+// PR could touch — were green in every one of them.
+
+import { execFileSync } from 'node:child_process';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import test from 'node:test';
+import { audit } from './audit.ts';
+import { NON_GATE_STEPS } from './declarations.ts';
+import { categories, covered, loadModel, type Model } from './model.ts';
+import type { Lane } from './workflows.ts';
+import { CHECK_CATALOG } from '../check-affected/checks.ts';
+
+const repoRoot = path.resolve(import.meta.dirname, '../..');
+const tracked = execFileSync('git', ['ls-files'], {
+  cwd: repoRoot,
+  encoding: 'utf8',
+})
+  .split('\n')
+  .filter(Boolean);
+const base = loadModel(repoRoot, tracked);
+
+function mutate(change: (model: Model) => Partial<Model>): Model {
+  return { ...base, ...change(base) };
+}
+
+function messages(model: Model, declared = NON_GATE_STEPS): string[] {
+  return audit(model, declared).map((failure) => failure.message);
+}
+
+function mapLane(
+  model: Model,
+  match: (lane: Lane) => boolean,
+  change: (lane: Lane) => Lane,
+): Lane[] {
+  return model.lanes.map((lane) => (match(lane) ? change(lane) : lane));
+}
+
+test('the live tree is green — every planted failure below is a real difference', () => {
+  assert.deepEqual(messages(base), []);
+});
+
+test('deleting the lane that runs a gate reports exactly that gate, naming the runner', () => {
+  const model = mutate((m) => ({
+    lanes: mapLane(
+      m,
+      (lane) => lane.gates.includes('fuzz-parsers'),
+      (lane) => ({
+        ...lane,
+        gates: lane.gates.filter((id) => id !== 'fuzz-parsers'),
+      }),
+    ),
+  }));
+  const found = messages(model);
+  assert.equal(found.length, 1);
+  assert.match(
+    found[0] ?? '',
+    /check "fuzz-parsers" is not run by any pull_request\/schedule lane/,
+  );
+  assert.match(found[0] ?? '', /pnpm gate fuzz-parsers/);
+});
+
+test('a gate outside the test:/check: naming convention is still owned — the #1714 hole', () => {
+  // `fuzz:parsers` resolves to an executable, not a Vitest project or a --test file.
+  // Under the old design that made it invisible to the suite universe; here it is a
+  // registered check like any other, so nothing has to recognise its shape.
+  const spec = CHECK_CATALOG.find((entry) => entry.id === 'fuzz-parsers');
+  assert.ok(spec);
+  const result = covered(spec, null, base);
+  assert.ok(result.covered);
+  assert.deepEqual(result.lanes, ['Replay Nightly / Parser Fuzz Lane']);
+});
+
+test('a docs-only change still reaches the command-reference gate (#1420)', () => {
+  const model = mutate((m) => ({
+    lanes: mapLane(
+      m,
+      (lane) => lane.workflow === 'pr-preview.yml',
+      (lane) => ({ ...lane, paths: ['website/assets/**'] }),
+    ),
+  }));
+  const found = messages(model);
+  assert.equal(found.length, 1);
+  assert.match(found[0] ?? '', /website\/docs\/docs\/commands\.md/);
+  assert.match(found[0] ?? '', /selects "command-docs"/);
+});
+
+test('per-unit coverage catches a lane deletion that whole-check ownership would miss', () => {
+  // command-docs-gate runs one unit-core FILE, so it must not stand in for the
+  // project when Coverage disappears.
+  const model = mutate((m) => ({
+    lanes: m.lanes.filter((lane) => lane.label !== 'Coverage'),
+  }));
+  const found = messages(model);
+  assert.ok(found.some((message) => /check "unit-ci" is not run/.test(message)));
+  assert.ok(found.some((message) => /check "vitest-related" is not run/.test(message)));
+});
+
+test('a path filter that excludes a category fails, though the check still runs somewhere', () => {
+  // Take the category's path from the derivation rather than naming a file, so the
+  // case keeps exercising the real classification as the tree changes.
+  const category = categories(base).find((entry) => entry.rule === 'own:daemon-wire-compat');
+  assert.ok(category, 'the wire ledger must still be a category');
+  const model = mutate((m) => ({
+    lanes: mapLane(
+      m,
+      (lane) => lane.workflow === 'ci.yml',
+      (lane) => ({
+        ...lane,
+        pathsIgnore: [...lane.pathsIgnore, category.path],
+      }),
+    ),
+  }));
+  const found = messages(model);
+  assert.ok(
+    found.every((message) => !/is not run by any/.test(message)),
+    'the checks still run somewhere — only this path stops reaching them',
+  );
+  assert.ok(found.some((message) => message.includes(category.path)));
+  assert.ok(found.some((message) => /selects "daemon-wire-compat"/.test(message)));
+});
+
+test('removing the opaque-runner declaration changes the audit, so it is not inert', () => {
+  const model = mutate(() => ({ opaque: {} }));
+  const found = messages(model);
+  assert.ok(found.some((message) => /check "unit" is not run/.test(message)));
+  assert.ok(found.some((message) => /vitest:unit-core/.test(message)));
+});
+
+test('a Vitest project no check runs is reported, and so is a suite script', () => {
+  const project = mutate((m) => ({
+    vitestProjects: [...m.vitestProjects, 'new-lane'],
+  }));
+  assert.ok(
+    messages(project).some((message) =>
+      /Vitest project "new-lane" is run by no registered check/.test(message),
+    ),
+  );
+
+  const script = mutate((m) => ({
+    scripts: {
+      ...m.scripts,
+      'test:orphan': 'vitest run --project unit-core --project orphan-only',
+    },
+    vitestProjects: [...m.vitestProjects, 'orphan-only'],
+  }));
+  assert.ok(
+    messages(script).some((message) =>
+      /package script "test:orphan" runs vitest:orphan-only/.test(message),
+    ),
+  );
+});
+
+test('categories are derived from the tracked tree, so no sample can be fictional', () => {
+  const found = categories(base);
+  assert.ok(found.length >= 12, `expected the selector's real categories, got ${found.length}`);
+  for (const category of found) {
+    assert.ok(tracked.includes(category.path), `${category.path} must be a tracked file`);
+    assert.ok(category.checks.length > 0, `${category.rule} must select at least one check`);
+  }
+  // The #1420 category in particular has to be present, since ci.yml ignores website/**.
+  const docs = found.find((category) => category.rule === 'own:command-docs');
+  assert.equal(docs?.path, 'website/docs/docs/commands.md');
+  assert.deepEqual(docs?.checks, ['command-docs']);
+});