diff --git a/.dockerignore b/.dockerignore
index 1b9aa11ca5..ee773610d5 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -37,3 +37,8 @@ packages/paperclip-runner/scripts/*-smoke.mjs
 # now guards this in PR CI.
 !packages/paperclip-runner/generated/**
 !packages/paperclip-runner/docs/capability-contract.md
+# check:runner-workflow-traceability access()es every regression test the
+# stress-traceability spec names — those are src/**/*.test.ts files, so
+# they must survive the *.test.ts rule above.
+!packages/paperclip-runner/src/**/*.test.ts
+!packages/paperclip-runner/src/**/*.test.tsx
diff --git a/.github/docker-context-checks.Dockerfile b/.github/docker-context-checks.Dockerfile
index 48f5921d9c..b259714bb7 100644
--- a/.github/docker-context-checks.Dockerfile
+++ b/.github/docker-context-checks.Dockerfile
@@ -31,6 +31,23 @@ RUN test -f packages/paperclip-runner/generated/capability/semantic-tool-contrac
  && test -f packages/paperclip-runner/generated/semantic-action-catalog.json \
  && test -f packages/paperclip-runner/spec/evals/stress-workflow-traceability.json \
  && test -d packages/paperclip-runner/protocol/fixtures/replay
+# check:runner-workflow-traceability access()es every regression test its
+# spec names (it needs dist/ to RUN, so it cannot run here) — replicate
+# exactly its existence walk, driven by the spec itself so this never
+# needs a hand-maintained path list. (2026-09-04, second unmasking: the
+# *.test.ts ignore rule stripped src/contracts/native-execution.test.ts
+# and the image build failed there once the capability checks were fixed.)
+RUN node -e ' \
+  const manifest = require("/context/packages/paperclip-runner/spec/evals/stress-workflow-traceability.json"); \
+  const { accessSync } = require("node:fs"); \
+  const { resolve } = require("node:path"); \
+  let count = 0; \
+  for (const finding of manifest.findings) \
+    for (const path of finding.regressionTests) { \
+      accessSync(resolve("/context/packages/paperclip-runner", path)); \
+      count += 1; \
+    } \
+  console.log(`traceability regression-test paths present: ${count}`);'
 # ajv is installed in an isolated directory (the runner's own package.json
 # uses workspace: ranges npm cannot install from) and symlinked in so ESM
 # resolution finds it from the scripts' location.