diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 26a3fbf3c..83324e303 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -225,6 +225,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          # test_gitleaks_ignore.py resolves historical fingerprints against
+          # branch- and tag-reachable commits, so it needs full history.
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
diff --git a/scripts/tests/test-hot-dev-bg.sh b/scripts/tests/test-hot-dev-bg.sh
index 74bb5ab1b..42002cd70 100755
--- a/scripts/tests/test-hot-dev-bg.sh
+++ b/scripts/tests/test-hot-dev-bg.sh
@@ -674,19 +674,26 @@ path_env = {
 go_mod = Path(os.environ["GO_MOD_PATH"]).read_text(encoding="utf-8")
 
 subsystem = next(item for item in registry["subsystems"] if item["id"] == "deployment-installability")
-policy = next(
-    item
-    for item in subsystem["verification"]["path_policies"]
-    if item["id"] == "dev-runtime-orchestration"
-)
+policies = subsystem["verification"]["path_policies"]
 owned = set(subsystem["owned_files"])
-matched = set(policy["match_files"])
+
+
+def effective_policy(path):
+    # First match wins, mirroring canonical_completion_guard.path_policy_matches.
+    for policy in policies:
+        prefixes = policy.get("match_prefixes", [])
+        if any(path == prefix.rstrip("/") or path.startswith(prefix) for prefix in prefixes) or path in policy.get(
+            "match_files", []
+        ):
+            return policy["id"]
+    return None
+
 
 for path in paths:
     exists = Path(os.environ[path_env[path]]).is_file()
     print(f"{path}:exists={exists}")
     print(f"{path}:owned={path in owned}")
-    print(f"{path}:policy={path in matched}")
+    print(f"{path}:policy={effective_policy(path)}")
     print(f"{path}:contract={f'`{path}`' in contract}")
 
 print(f"go.mod:uses_moby_api={'github.com/moby/moby/api' in go_mod}")
@@ -703,9 +710,17 @@ PY
     "frontend-modern/vite.config.ts" \
     "go.mod" \
     "go.sum"; do
+    case "${manifest_path}" in
+      frontend-modern/package.json | frontend-modern/package-lock.json)
+        expected_policy="frontend-dependency-security"
+        ;;
+      *)
+        expected_policy="dev-runtime-orchestration"
+        ;;
+    esac
     assert_contains "dev runtime manifest exists: ${manifest_path}" "${output}" "${manifest_path}:exists=True"
     assert_contains "dev runtime manifest owned: ${manifest_path}" "${output}" "${manifest_path}:owned=True"
-    assert_contains "dev runtime manifest has proof policy: ${manifest_path}" "${output}" "${manifest_path}:policy=True"
+    assert_contains "dev runtime manifest has proof policy: ${manifest_path}" "${output}" "${manifest_path}:policy=${expected_policy}"
     assert_contains "dev runtime manifest is in contract: ${manifest_path}" "${output}" "${manifest_path}:contract=True"
   done