@@ -124,29 +124,43 @@ fn an_effect_verdict_carries_every_line_the_door_accepts() {
 /// from `!= 0`.
 #[test]
 fn a_non_positive_site_takes_the_registration_fallback() {
+    // Asserted as an EXACT anchor, not as "did not use the site". The weaker
+    // form catches the `>= 1` -> `!= 0` refactor and would still pass if the
+    // fallback landed on some third coordinate — an assertion that does not
+    // say what its own name says.
     for line in [i64::MIN, -1, 0] {
-        for (file, got, code) in di_verdicts(&di004(line)) {
-            assert_ne!(
-                (file.as_str(), got.get()),
-                ("call.cs", line),
-                "{code}: a site at line {line} was used as the anchor; `>= 1` \
-                 must send it to the registration fallback. A refactor to \
-                 `!= 0` passes every previously existing test and fails here — \
-                 which is the whole reason this control exists."
-            );
-        }
+        let di004_verdicts: Vec<_> = di_verdicts(&di004(line))
+            .into_iter()
+            .filter(|(_, _, code)| *code == "DI004")
+            .collect();
+        let (file, got, _) = di004_verdicts
+            .first()
+            .unwrap_or_else(|| panic!("DI004 expected for a site at line {line}"));
+        assert_eq!(
+            (file.as_str(), got.get()),
+            ("reg.cs", 5),
+            "a site at line {line} must anchor at the REGISTRATION site \
+             (reg.cs:5). A refactor to `!= 0` passes every previously existing \
+             test and fails here — which is the whole reason this control \
+             exists — and so does a fallback that picks some other coordinate."
+        );
     }
 }
 
 #[test]
 fn a_positive_site_beyond_u32_is_still_a_site() {
     // The other half: the sentinel must not have become "small enough to fit".
     for line in [1_i64, 4_294_967_296, i64::MAX] {
-        let used_site = di_verdicts(&di004(line))
-            .iter()
-            .any(|(file, got, _)| file == "call.cs" && got.get() == line);
-        assert!(
-            used_site,
+        let di004_verdicts: Vec<_> = di_verdicts(&di004(line))
+            .into_iter()
+            .filter(|(_, _, code)| *code == "DI004")
+            .collect();
+        let (file, got, _) = di004_verdicts
+            .first()
+            .unwrap_or_else(|| panic!("DI004 expected for a site at line {line}"));
+        assert_eq!(
+            (file.as_str(), got.get()),
+            ("call.cs", line),
             "a site at line {line} did not anchor the verdict — the sentinel \
              narrowed to something a u32 can hold"
         );
 
@@ -137,3 +137,61 @@ fn ordering_over_the_band_is_signed_and_total() {
          which would reorder every emitted diagnostic on a file that has one"
     );
 }
+
+/// The **secondary** projection path, which the primary control cannot reach.
+///
+/// `Evidence.line` travels a different route to SARIF: `steps_for` copies it
+/// into a `Step`, `emittable` applies the `>= 1` gate, and `related_locations`
+/// and `code_flow` each build a `Region` from it. So a truncation introduced in
+/// `steps_for` leaves every other control here green — `EvidenceIdentity`
+/// inspects the `Evidence`, and the primary region never passes through a
+/// `Step` at all.
+///
+/// Both consumers are asserted, not just one: they share `emittable` today, and
+/// a control that only checked `relatedLocations` would be relying on that.
+#[test]
+fn the_secondary_sarif_path_carries_evidence_lines_over_the_band() {
+    let expected: [(i64, Option<i64>); 5] = [
+        (-1, None),
+        (0, None),
+        (1, Some(1)),
+        (ABOVE_U32, Some(ABOVE_U32)),
+        (i64::MAX, Some(i64::MAX)),
+    ];
+    for (line, want) in expected {
+        let d = diag(1).with_evidence(vec![
+            Evidence::new(SourceLine(line), "registered here").with_role("registered")
+        ]);
+        let log = build_sarif(&[d], "A.cs", "error");
+        let result = &log.runs[0].results[0];
+
+        let related: Vec<i64> = result
+            .related_locations
+            .iter()
+            .filter_map(|l| l.physical_location.region.as_ref())
+            .map(|r| r.start_line.get())
+            .collect();
+        let flow: Vec<i64> = result
+            .code_flows
+            .iter()
+            .flat_map(|f| f.thread_flows.iter())
+            .flat_map(|t| t.locations.iter())
+            .filter_map(|l| l.location.physical_location.region.as_ref())
+            .map(|r| r.start_line.get())
+            .collect();
+
+        let want_vec: Vec<i64> = want.into_iter().collect();
+        assert_eq!(
+            related, want_vec,
+            "evidence line {line}: relatedLocations mismatch — below 1 the \
+             secondary location is dropped entirely, at or above it the value \
+             rides through verbatim"
+        );
+        assert_eq!(
+            flow, want_vec,
+            "evidence line {line}: codeFlows mismatch. relatedLocations and \
+             codeFlows are two separate consumers of the same Step; checking \
+             only one would lean on them sharing `emittable` today"
+        );
+    }
+}