@@ -68,7 +68,8 @@ A parent HelmRelease that hit its wait timeout, uninstalled, and reinstalled is
 
 `hack/select-e2e.sh` walks the `packages/core/platform/sources/*.yaml` dependency graph and runs only the Chainsaw suites affected by a diff. A suite is a directory under `hack/e2e-chainsaw/` containing a `chainsaw-test.yaml`.
 
-- Conservative escalation: edits to `packages/library/`, `packages/core/`, `api/`, `cmd/`, `internal/`, top-level `hack/*.sh|*.bats` helpers, the shared `hack/e2e-chainsaw/_lib/`, the chainsaw config `hack/e2e-chainsaw/.chainsaw.yaml`, the `Makefile`, or `.github/workflows/pull-requests.yaml` escalate to the **full suite**. A per-suite edit (any file under `hack/e2e-chainsaw/<app>/`) selects **only** that suite. Note the exception, since "the E2E workflows" would be the natural reading: the selector's list names `pull-requests.yaml` and not `e2e-fork.yaml`, so a change touching only the fork workflow selects nothing and the Chainsaw step is skipped, while the platform install and the OpenAPI tests still run. That is tolerable rather than designed, and it is tolerable for a specific reason: a `workflow_run` always executes the default-branch copy of `e2e-fork.yaml`, so running the suite against a change to it would not exercise that change anyway. It is the same fail-open shape as #3392.
+- Conservative escalation: edits to `packages/library/`, `packages/core/`, the Go trees (`api/`, `cmd/`, `internal/`, `pkg/`), the codegen under `tools/`, `go.mod`/`go.sum`, top-level `hack/*.sh|*.bats` helpers and the `hack/lib/` they source, `hack/*.mk`, `hack/buildkitd.toml`, `hack/e2e-*.yaml`, the shared `hack/e2e-chainsaw/_lib/`, the chainsaw config `hack/e2e-chainsaw/.chainsaw.yaml`, the `Makefile`, or any workflow that runs the suite escalate to the **full suite**. A per-suite edit (any file under `hack/e2e-chainsaw/<app>/`) selects **only** that suite.
+- **Every path is classified, and an unclassified one escalates.** The selector has three outcomes — full suite, a scoped set, or nothing — and each is reached by an explicit rule: `full_suite_pattern` for shared build inputs and the e2e harness, `inert_config_pattern` for paths that cannot affect what e2e exercises (repo meta, `.github/` bar the e2e workflows, agent config, `hack/testdata/`), and the graph lookup for `packages/(apps|system|extra)/`. A path matching none of them escalates to the full suite and logs why, because both lanes read an empty selection as "skip Chainsaw" and then post `E2E Tests` green — so a silent default is a green gate with nothing tested (#3392). When that escalation fires for something genuinely inert, add it to `inert_config_pattern`; do not relax the fall-through. The escalation list and the inert list are checked in that order, so a specific escalation beats a broad inert directory.
 - The `full-e2e` PR label forces the whole suite.
 - The selection is passed to `make test-chainsaw CHAINSAW_SUITES="<names>"`, which runs `chainsaw test <names>` from `hack/e2e-chainsaw/` (empty = the whole suite).
 - The coverage gap TIA opens on PRs is closed at release-cut time: the "Prepare release" commit bakes image digests into `packages/core/` (and other packages), which TIA escalates to the **full** suite — so the release PR exercises the whole suite against the commit the tag will point at.
@@ -82,7 +83,7 @@ Be precise about TIA's scope — it is narrower than "skip E2E for unrelated PRs
 - **It trims only which suites `chainsaw test` runs, not the expensive stages.** `Prepare environment` and `Install Cozystack` (the full platform install) run regardless of the selection. TIA only decides the `CHAINSAW_SUITES` passed to the final E2E step. A perfect narrow saves the suite tail, not the bulk of wall-time. (Package image builds are scoped separately — by `hack/build-matrix.sh`, on the PR diff — while the Talos and installer/finalize legs still run for non-docs PRs; that is a distinct mechanism from TIA's suite trimming.)
 - **`Select E2E tests` runs *after* `Install Cozystack` and has no `always()`.** GitHub implicitly ANDs a step's `if:` with `success()`, so if install fails the selector (and `Run E2E tests`) are skipped entirely. On a red install you will not see TIA narrow anything — that is the ordering, not a selector bug.
 - **Most PRs legitimately escalate to the full suite.** Platform manifests live under `packages/core/`, Go under `api/`/`internal/`, helpers under `hack/`, plus the `Makefile` — touching any one triggers the full suite. So "all suites selected" is usually correct, not a failure to narrow.
-- **Two skip layers, with a gap.** The `plan` job computes a coarse docs-only gate (`code`, true for any change outside `docs/**`) that skips the whole build+E2E pipeline for docs-only PRs, plus a per-package build matrix (`hack/build-matrix.sh`) that scopes which images build. TIA's finer skip (`select-e2e.sh` ignoring `docs/`, `dashboards/`, and `*.md`) only trims the suite selection. A PR touching only `dashboards/*.json` therefore still runs install, then skips just the Chainsaw suites — near-zero savings. If you need such PRs to skip the pipeline, widen the `plan` docs-gate, not `select-e2e.sh`.
+- **Two skip layers, with a gap.** The `plan` job computes a coarse docs-only gate (`code`, true for any change outside `docs/**`) that skips the whole build+E2E pipeline for docs-only PRs, plus a per-package build matrix (`hack/build-matrix.sh`) that scopes which images build. TIA's finer skip (`select-e2e.sh` ignoring `docs/`, `dashboards/`, `*.md` and the rest of `inert_config_pattern`) only trims the suite selection. A PR touching only `dashboards/*.json` therefore still runs install, then skips just the Chainsaw suites — near-zero savings. If you need such PRs to skip the pipeline, widen the `plan` docs-gate, not `select-e2e.sh`.
 
 ### 8. Failure must be self-explanatory — diagnostics are first-class
 
 
@@ -6,11 +6,21 @@
 # Defaults: sources-dir = packages/core/platform/sources
 #
 # Output:
-#   - empty         no E2E impact (docs / dashboards / *.md only)
+#   - empty         no E2E impact — an explicitly INERT path (docs, dashboards,
+#                   *.md, repo meta files; see inert_config_pattern)
 #   - <suite names> selected per the PackageSource dependency graph
 #   - full list     any path that affects all tests, OR an unrecognised
 #                   packages/* path, OR a per-app source whose graph has
-#                   no *-application descendants (conservative fallback)
+#                   no *-application descendants, OR a path matching NEITHER
+#                   the full-suite nor the inert list (conservative fallbacks)
+#
+# Every changed path must land in exactly one of those three classes by an
+# explicit rule. An unclassified path escalates to the full suite rather than
+# selecting nothing: both e2e lanes read an empty selection as "skip Chainsaw"
+# and then post the required "E2E Tests" status green, so a silent default is a
+# green gate with no suite run (#3392). When that escalation fires for a path
+# that genuinely cannot affect e2e, add it to inert_config_pattern — do not
+# widen the fall-through.
 set -eu
 
 CHANGED="${1:?missing changed-files arg}"
@@ -20,7 +30,35 @@ SOURCES_DIR="${2:-packages/core/platform/sources}"
 # edits (hack/e2e-chainsaw/<name>/...) are matched BEFORE this so editing one
 # suite doesn't escalate to the full suite; the shared _lib helpers and the
 # .chainsaw.yaml config affect every suite and DO escalate (handled inline).
-full_suite_pattern='^(packages/library/|packages/core/|api/|cmd/|internal/|hack/[^/]+\.sh$|hack/[^/]+\.bats$|Makefile$|\.github/workflows/pull-requests\.yaml$)'
+#
+# Three groups, all "cannot be scoped to one app":
+#   - shipped code and its build inputs: packages/library, packages/core, the Go
+#     trees (api, cmd, internal, pkg), the codegen under tools/, go.mod/go.sum,
+#     the root Makefile, hack/*.mk (the tag/push/output flags of every image),
+#     hack/buildkitd.toml (the builder every image is built with), and hack/lib/
+#     (sourced by the hack/*.sh scripts that already escalate);
+#   - the e2e harness itself: hack/*.sh, hack/*.bats and hack/e2e-*.yaml;
+#   - the workflows that RUN the suite — enumerated rather than matched by
+#     prefix, so an unrelated workflow does not burn a full run. Keep this list
+#     in step with `rg -l test-chainsaw .github/workflows/`.
+full_suite_pattern='^(packages/library/|packages/core/|api/|cmd/|internal/|pkg/|tools/|hack/lib/|hack/[^/]+\.sh$|hack/[^/]+\.bats$|hack/[^/]+\.mk$|hack/buildkitd\.toml$|hack/e2e-[^/]+\.ya?ml$|go\.(mod|sum)$|Makefile$|\.github/workflows/(pull-requests|e2e-fork|e2e-tag|nightly)\.yaml$)'
+
+# Paths with no bearing on what e2e exercises. Checked AFTER full_suite_pattern,
+# so a specific escalation wins over a broad directory here (.github/ is inert,
+# .github/workflows/pull-requests.yaml is not). This list is the whole reason
+# the fall-through at the bottom of the loop can escalate safely: the cost of
+# forgetting an inert path is a wasted full run, the cost of forgetting a live
+# one used to be a green gate with nothing tested.
+#   - examples/       demo manifests; examples/backups/<app>/ is handled above
+#                     as a real test harness before this check is reached
+#   - .github/        templates, CODEOWNERS, labels, renovate, linter config —
+#                     minus the e2e workflows escalated above
+#   - .claude/ .gemini/  agent config, never shipped
+#   - img/            README assets
+#   - hack/testdata/  fixtures for the bats unit tests, not for e2e
+#   - boilerplate.go.txt / dcgm-default-counters.csv  codegen header; a CSV read
+#                     only by check-gpu-recording-rules.bats
+inert_config_pattern='^(examples/|\.github/|\.claude/|\.gemini/|img/|hack/testdata/|hack/boilerplate\.go\.txt$|hack/dcgm-default-counters\.csv$|LICENSE$|\.gitignore$|\.pre-commit-config\.yaml$|\.coderabbit\.yaml$)'
 
 # All known Chainsaw suites: every dir under hack/e2e-chainsaw/ holding a
 # chainsaw-test.yaml (this excludes _lib/ and the top-level config files).
@@ -74,7 +112,9 @@ selected_apps=""
 while IFS= read -r file; do
   [ -z "$file" ] && continue
 
-  # 1. Skip: docs, dashboards, *.md
+  # 1. Skip: docs, dashboards, *.md. Checked before everything else because
+  #    these can never matter wherever they live — a README inside
+  #    packages/core/ must not escalate the way its templates do.
   if echo "$file" | grep -qE '^(docs/|dashboards/)' || echo "$file" | grep -qE '\.md$'; then
     continue
   fi
@@ -111,7 +151,12 @@ while IFS= read -r file; do
     continue
   fi
 
-  # 4. Component change: lookup in PackageSource graph
+  # 4. Explicitly inert: repo meta, agent config, non-e2e workflows, fixtures.
+  if echo "$file" | grep -qE "$inert_config_pattern"; then
+    continue
+  fi
+
+  # 5. Component change: lookup in PackageSource graph
   rel=$(echo "$file" | sed -nE 's,^packages/(apps|system|extra)/([^/]+)/.*,\1/\2,p')
   if [ -n "$rel" ]; then
     src=$(echo "$OWNERS" | awk -v p="$rel" -F'\t' '$1==p {print $2}')
@@ -122,9 +167,15 @@ while IFS= read -r file; do
       # Inside packages/ but no graph entry — be conservative.
       trigger_full=1
     fi
+    continue
   fi
-  # Anything else (e.g. unrelated workflow files, top-level configs) is
-  # silently ignored.
+
+  # 6. Unclassified. Escalate instead of ignoring: an empty selection makes both
+  #    e2e lanes skip Chainsaw and post "E2E Tests" green, so a path nobody has
+  #    classified must fail safe, not fail open (#3392). Add genuinely inert
+  #    paths to inert_config_pattern rather than relaxing this.
+  echo "select-e2e: unclassified path '$file' — escalating to the full suite (classify it in hack/select-e2e.sh, see #3392)" >&2
+  trigger_full=1
 done < "$CHANGED"
 
 if [ "$trigger_full" = 1 ]; then
 
@@ -170,3 +170,107 @@
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources") || true
     [ -z "$output" ]
 }
+
+# --- #3392: every path is classified; unclassified escalates -----------------
+#
+# The bug these cover: an unrecognised path used to select nothing, both lanes
+# read an empty selection as "skip Chainsaw", and the required "E2E Tests"
+# status was then posted green with no suite run. Each test below pins one side
+# of the classification — escalate, or skip by an explicit rule.
+
+@test "hack/*.mk triggers full suite (build flags of every image)" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "hack/common-envs.mk" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "the fork e2e workflow triggers full suite" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo ".github/workflows/e2e-fork.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "pkg/ triggers full suite (shipped Go code)" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "pkg/cozystack/registry.go" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "go.mod triggers full suite" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "go.mod" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "hack/lib helper triggers full suite" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "hack/lib/image-refs.sh" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "an unclassified path escalates instead of selecting nothing" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "brand-new-top-level/thing.conf" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources" 2>/dev/null)
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "inert repo meta selects nothing" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    printf '%s\n' .gitignore LICENSE .pre-commit-config.yaml > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ -z "$output" ]
+}
+
+@test "a non-e2e workflow selects nothing, an e2e one still escalates" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    # .github/ is inert as a directory, but the escalation for the workflows
+    # that run the suite is checked first and must win.
+    echo ".github/workflows/tags.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ -z "$output" ]
+    echo ".github/workflows/e2e-tag.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$(echo "$output" | wc -w)" -gt 5 ]
+}
+
+@test "a README inside an escalating tree stays inert" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    # packages/core/ escalates, but *.md is matched before that so a doc edit
+    # under it does not burn a full run.
+    echo "packages/core/installer/README.md" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ -z "$output" ]
+}
+
+@test "an inert path alongside a real one does not mask the selection" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    printf '%s\n' .gitignore packages/apps/postgres/values.yaml > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    [ "$output" = "postgres" ]
+}