@@ -548,8 +548,14 @@ jobs:
   # digest-pinned KubeVirt containerDisk pushed to the registry, and stamps the
   # ref@digest into packages/apps/site-router/images/vyos-router-disk.tag.
   # That stamp is captured as a patch fragment so finalize bundles the real digest
-  # into the installer artifact (the deferred site-router e2e resolves it from
-  # there). vm-default-images is an opt-in bundle package, so a non-opted-in e2e is
+  # into the installer artifact, which is where the site-router e2e resolves it
+  # from. That suite runs in CI, and when this job is skipped the ref comes from
+  # the base branch instead: `make build` builds this package before
+  # packages/core/installer, so the cozystack-packages artifact carries the
+  # stamped .tag and finalize's overlay applies it. Only a base branch that has
+  # not been built since the package landed leaves the committed placeholder in
+  # place — see the note in hack/e2e-chainsaw/site-router/chainsaw-test.yaml.
+  # vm-default-images is an opt-in bundle package, so a non-opted-in e2e is
   # unaffected either way.
   #
   # Path-scoped (plan.outputs.vyos): this heavy, privileged build only runs when
 
@@ -4,15 +4,33 @@
 # GATE — the negative-security matrix (every forbidden flow dropped AND attributed
 # to the guard that dropped it).
 #
-# ── DEFERRED FROM CI ────────────────────────────────────────────────────────
-# This suite CANNOT run green in CI yet: the VyOS golden image is committed
-# DISABLED (T01) and the VyOS 1.5 firewall syntax is provisional (TODO(T13)). It
-# is therefore excluded from TIA selection AND from the full suite by an explicit
-# deferral in hack/select-e2e.sh, so the PR that adds it keeps CI green. It runs
-# only in the empirical validation, by hand:
+# ── RUNS IN CI ──────────────────────────────────────────────────────────────
+# The suite is enumerated like every other one (hack/select-e2e.sh finds a suite
+# by its chainsaw-test.yaml), so it runs on a site-router change and in every
+# full-suite escalation.
+#
+# The appliance it boots is stamped, not committed. Two paths supply the stamp
+# and between them they cover every run. On a PR that touches a vyos path the
+# build-vyos job publishes the golden image and writes the real ref@digest into
+# packages/apps/site-router/images/vyos-router-disk.tag through a patch fragment
+# the Finalize step merges before the E2E job reads it. On every other PR that
+# job is skipped (it is path-scoped on plan.outputs.vyos), and the ref instead
+# arrives from the base branch: the root `build:` recipe builds
+# packages/system/vyos-router-image before packages/core/installer, so the
+# cozystack-packages artifact pushed from main already carries the stamped .tag,
+# and finalize's overlay copies it onto this tree.
+#
+# What is NOT covered is legibility when neither path fires — a main build that
+# has not run since this package landed, or an overlay that could not pull the
+# artifact and logged a no-op. The committed value is then the bare v0.0.0
+# placeholder, which no build path in this repo ever publishes, and the guard in
+# the bring-up step below only rejects an EMPTY ref, so the run fails as an
+# eight-minute VM-never-ready timeout rather than naming the cause. Rejecting a
+# ref that carries no @sha256: digest would fix that; it is not done here.
+#
+# To drive it by hand against a dev cluster:
 #     make test-chainsaw CHAINSAW_SUITES="site-router"
-# with the golden image published (or supplied via an uncommitted image override)
-# and the live-only script seams (_probe-lib.sh) implemented.
+# which needs the golden image published, or supplied via an image override.
 #
 # ── ONE Test, not many ──────────────────────────────────────────────────────
 # The topology is expensive (two nested KubeVirt VMs + IPsec), so it is brought
@@ -412,9 +430,11 @@ spec:
         is live (D8). The pod name is generated, so this selects by the KubeVirt
         label and polls (a non-empty result AND value=false — never a vacuous
         empty-list pass).
-        TODO(T13): this depends on the guest source-filter confirm, which depends
-        on the provisional VyOS 1.5 firewall syntax pushing successfully. Live
-        validation must also cover the port_security live-toggle question the
+        This rides on the guest source-filter confirm, and through it on the
+        VyOS 1.5 firewall syntax pushing successfully — validated live against
+        the shipped image (packages/apps/site-router/docs/security-model.md),
+        so no longer provisional.
+        What is still open is the port_security live-toggle question the
         reconciler flags (D8): whether kube-ovn v1.15.10 reconciles the LSP
         port_security field from an annotation flip on an already-wired port.
       try:
@@ -506,8 +526,8 @@ spec:
         From B, reach the backend behind A through the tunnel; the backend's
         /clientip must report B's REAL remote source (192.0.2.x), proving routed
         mode preserves the source (no NAT). THE routed-mode contract.
-        TODO(T13): live — implement probe_from_b in _probe-lib.sh (drive B's
-        guest). Validate source preservation end to end against the live image.
+        The probe is driven from B's guest over SSH by probe_from_b_stdout
+        (_probe-lib.sh), so the source the backend reports is B's real one.
       try:
         - script:
             timeout: 5m
@@ -532,8 +552,8 @@ spec:
       description: >-
         A multi-MB transfer B → backend across the tunnel must complete without
         stalling — the TCP MSS clamp (overlay MTU − 40) preventing PMTU black-holes.
-        TODO(T13): live — implement the bulk transfer from B's guest; a stall
-        (hang until timeout) is the failure signal.
+        A stall — the transfer hanging until the step timeout rather than
+        erroring — is the failure signal.
       try:
         - script:
             timeout: 5m
@@ -558,10 +578,11 @@ spec:
         establishing the responsible guard, not merely absence of connectivity.
         The one allowed flow (declared remote source → intended same-tenant
         destination) must pass with source preserved.
-        TODO(T13): live — implement probe_from_b / hubble_dropped /
-        guest_counter_incremented in _probe-lib.sh against the live gateway,
-        Hubble, and the VyOS management API. The stubs fail loudly, so this GATE
-        can never pass vacuously.
+        The guards read the live gateway: guest counters over the VyOS
+        management API, Cilium drops from the datapath drop monitor
+        (_probe-lib.sh). Every helper fails loudly when its evidence is absent —
+        an unreadable counter is not a flat one — so this GATE cannot pass
+        vacuously.
       try:
         - script:
             timeout: 10m
 
@@ -119,15 +119,25 @@ assert_full_suite() {
 }
 
 @test "a CDI change selects the suite that exercises a VMDisk" {
-    # kubevirt-cdi reaches vm-disk-application and nothing else runnable, so
-    # until vm-disk-application mapped to a suite every CDI change ran all of
-    # them. The vminstance suite creates a VMDisk and asserts the DataVolume
-    # behind it, so it is the suite that covers CDI.
+    # kubevirt-cdi reached no runnable suite until vm-disk-application mapped to
+    # one, so every CDI change ran all of them. The vminstance suite creates a
+    # VMDisk and asserts the DataVolume behind it, so it is the suite that
+    # covers CDI, and this pins that it is selected.
+    #
+    # Membership, not equality: what the rule owes is that the VMDisk suite is
+    # IN the selection, and CDI legitimately reaches more than one suite —
+    # site-router's gateway boots from a CDI-provisioned DataVolume, so enabling
+    # that suite widens this to `site-router vminstance`. An exact set would
+    # read a correct widening as a regression. Dropping vminstance from the
+    # mapping still fails this, which is what it guards.
     tmp=$(mktemp -d)
     cp -r packages/core/platform/sources "$tmp/sources"
     echo "packages/system/kubevirt-cdi/values.yaml" > "$tmp/diff"
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
-    [ "$output" = "vminstance" ]
+    if ! echo "$output" | grep -wq vminstance; then
+        echo "a CDI change must select the vminstance suite; got: $output" >&2
+        exit 1
+    fi
     rm -rf "$tmp"
 }
 
@@ -999,18 +1009,17 @@ assert_full_suite() {
     [ "$count" -eq 2 ]
 }
 
-@test "site-router is parked, so a change to its app escalates to the full suite" {
-    # The site-router suite is authored but cannot run until its appliance image
-    # is published, so it is parked as chainsaw-test.yaml.disabled and is not a
-    # suite as far as the selector is concerned. Its app therefore reaches no
-    # runnable suite and escalates, which is the #3330 rule rather than a
-    # special case — and is why parking it must NOT be spelled as a
-    # strip-the-name-from-the-output filter. Doing that leaves the walk still
-    # reaching the name, so any package whose only coverage ran through
-    # site-router (cozystack-basics and kubevirt-cdi both do, via kubevirt-cdi
-    # -> site-router-application) resolves to one suite, has it stripped, and
-    # selects NOTHING — a full-suite escalation silently turned into a skipped
-    # Chainsaw run and a green "E2E Tests" (#3392).
+@test "a change to the site-router app selects its own suite" {
+    # The suite is live: it carries a chainsaw-test.yaml, so the selector sees it
+    # like any other and a change to the app it covers resolves to it and to
+    # nothing else. It must never be parked back by stripping the name from the
+    # selector output. Doing that leaves the walk still reaching the name, so any
+    # package whose only coverage runs through site-router (cozystack-basics and
+    # kubevirt-cdi both do, via kubevirt-cdi -> site-router-application) resolves
+    # to one suite, has it stripped, and selects NOTHING — a full-suite
+    # escalation silently turned into a skipped Chainsaw run and a green
+    # "E2E Tests" (#3392). Park it by renaming the file, the way
+    # hack/e2e-chainsaw/backup/ is parked, or not at all.
     #
     # These three clean up at the end of the body rather than from an EXIT trap:
     # a test-level trap displaces the handler the bats binary installs, and a
@@ -1021,47 +1030,55 @@ assert_full_suite() {
     cp -r packages/core/platform/sources "$tmp/sources"
     echo "packages/apps/site-router/values.yaml" > "$tmp/diff"
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
-    assert_full_suite "$output"
+    [ "$output" = "site-router" ]
     rm -rf "$tmp"
 }
 
-@test "the packages that reach a suite only through site-router still escalate" {
-    # The regression guard for the paragraph above, pinned on the two packages
-    # that actually have this shape. Both reach site-router-application through
-    # kubevirt-cdi and nothing else runnable, so both must run everything rather
-    # than selecting the parked suite or, worse, nothing at all.
+@test "a change to kubevirt-cdi reaches the site-router suite" {
+    # CDI provisions the gateway's boot DataVolume, so it reaches
+    # site-router-application and a CDI change genuinely wants this suite.
+    #
+    # Membership, not equality. What must hold is that site-router is IN the
+    # selection: #3817 maps vm-disk-application onto vminstance, which gives CDI
+    # a second suite, and an exact-set assertion here would go red on that
+    # correct widening. Stripping the name from the output still fails this,
+    # which is the #3392 regression the guard exists for.
+    #
+    # cozystack-basics has the same shape today and is deliberately NOT pinned
+    # here. It is a propagation hub, its escalation is what the two escalation
+    # guards above own, and #3817 stops it propagating at all — so asserting a
+    # suite for it here would contradict those guards on the far side of that PR.
     tmp=$(mktemp -d)
     cp -r packages/core/platform/sources "$tmp/sources"
-    for pkg in packages/system/cozystack-basics/values.yaml \
-               packages/system/kubevirt-cdi/values.yaml; do
-        echo "$pkg" > "$tmp/diff"
-        output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
-        assert_full_suite "$output"
-    done
+    echo "packages/system/kubevirt-cdi/values.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    if ! echo "$output" | grep -wq site-router; then
+        echo "kubevirt-cdi must reach the site-router suite; got: $output" >&2
+        exit 1
+    fi
     rm -rf "$tmp"
 }
 
-@test "editing the parked site-router suite selects nothing" {
-    # A *.disabled suite is registered nowhere and executed by nothing, so an
-    # edit to it cannot regress a test. This is the existing rule for a parked
-    # suite (hack/e2e-chainsaw/backup/ is the other one), not a new one.
+@test "editing the site-router suite selects it" {
+    # A live suite is selected by an edit to its own directory, which is the
+    # ordinary per-suite rule and the thing parking it took away.
     tmp=$(mktemp -d)
     cp -r packages/core/platform/sources "$tmp/sources"
-    echo "hack/e2e-chainsaw/site-router/chainsaw-test.yaml.disabled" > "$tmp/diff"
+    echo "hack/e2e-chainsaw/site-router/chainsaw-test.yaml" > "$tmp/diff"
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
-    [ -z "$output" ]
+    [ "$output" = "site-router" ]
     rm -rf "$tmp"
 }
 
-@test "the parked site-router suite is excluded from the full suite" {
-    # The full-suite escalation enumerates chainsaw-test.yaml, so parking the
-    # file keeps the suite out of every escalation without a second mechanism.
+@test "the site-router suite is part of the full suite" {
+    # The full-suite escalation enumerates chainsaw-test.yaml, so a live suite
+    # joins every escalation without a second mechanism.
     tmp=$(mktemp -d)
     cp -r packages/core/platform/sources "$tmp/sources"
     echo "packages/system/cilium/values.yaml" > "$tmp/diff"
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
-    if echo "$output" | grep -wq site-router; then
-        echo "site-router is parked and must not appear in the full suite; got: $output" >&2
+    if ! echo "$output" | grep -wq site-router; then
+        echo "site-router is live and must appear in the full suite; got: $output" >&2
         exit 1
     fi
     rm -rf "$tmp"