diff --git a/.github/labeler.yml b/.github/labeler.yml
index 6ec4baf..c7a60bc 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -19,6 +19,20 @@
 # unmapped guard actions, RELEASES.md, README (which this tree spells
 # README.md, so the old glob could match nothing) — are the same read of the
 # same file, gaps rather than wrong answers.
+#
+# #302 is the same read once more, from #300's review: lib/attention.sh had
+# #267 D4's premise exactly (both reconcilers source it, nothing release-side
+# does) and was not in the rows — a wrong answer, not a gap. The sweep
+# workflow pair joins beside its trigger pair: the sweeps detached in #209
+# and took the reconcile jobs and the cron with them. Two asymmetries are
+# deliberate, not drift: the TESTS of the shared lib/ files take
+# scope:labels alone, because lib/ruling.sh and lib/read.sh wear
+# scope:release-flow only through the lib/** glob being kept whole and a
+# test file inherits no such glob; and there is still no test/** or
+# .github/scripts/** catch-all, because both directories span all four
+# scopes — a catch-all is the changelog.d/** defect again, 100% recall and
+# no locating power. The enumeration is the price of a test locating its
+# subject.
 scope:release-flow:
   - changed-files:
       - any-glob-to-any-file:
@@ -37,6 +51,9 @@ scope:release-flow:
           - test/version.test.sh
           - test/changelog.test.sh
           - test/self-ref.test.sh
+          - test/changelog-assemble.test.sh
+          - .github/scripts/release-path.sh
+          - test/release-path.test.sh
 scope:guards:
   - changed-files:
       - any-glob-to-any-file:
@@ -55,25 +72,38 @@ scope:guards:
           - test/drill-recorded.test.sh
           - test/refs-not-closing.test.sh
           - test/runner-isolated.test.sh
+          - .github/scripts/marker-check.sh
+          - test/marker-check.test.sh
+          - .github/scripts/vendored-check.sh
+          - test/vendored.test.sh
 scope:labels:
   - changed-files:
       - any-glob-to-any-file:
           - .github/workflows/labels.yml
           - .github/workflows/self-labels.yml
+          - .github/workflows/labels-sweep.yml
+          - .github/workflows/self-labels-sweep.yml
           - .github/labeler.yml
           - .github/labels.conf
           - actions/issueflow-reconcile/**
           - actions/labels-reconcile/**
           - actions/labels-scope/**
           # shared by both reconcilers; lib/** keeps scope:release-flow too,
-          # and a mixed file honestly wears both labels (#267 D4)
+          # and a mixed file honestly wears both labels (#267 D4, #302 D1)
           - lib/read.sh
           - lib/ruling.sh
+          - lib/attention.sh
           - LABELS.md
           - test/issueflow-reconcile.test.sh
           - test/labels.test.sh
           - test/labels-reconcile.test.sh
           - test/labels-scope.test.sh
+          # tests of the shared lib/ files: scope:labels ALONE — a test
+          # inherits no lib/** glob, so its row is the one scope its subject
+          # actually locates (#302 D3)
+          - test/attention.test.sh
+          - test/ruling.test.sh
+          - test/labels-triggers.test.sh
 scope:docs:
   - changed-files:
       - any-glob-to-any-file:
diff --git a/changelog.d/302.md b/changelog.d/302.md
new file mode 100644
index 0000000..c0a759a
--- /dev/null
+++ b/changelog.d/302.md
@@ -0,0 +1,6 @@
+### Fixed
+
+- `lib/attention.sh` locates as label machinery beside its two shelf-mates —
+  `[scope:release-flow]` alone was a wrong answer of the class #267 measured
+  — and the map learns the sweep workflow pair, the shared-lib tests, and
+  seven enumerated test/guard surfaces (#302).
diff --git a/test/labels-scope.test.sh b/test/labels-scope.test.sh
index 5e1c437..650d556 100644
--- a/test/labels-scope.test.sh
+++ b/test/labels-scope.test.sh
@@ -175,6 +175,57 @@ EOF
   check "derive: an unmapped path is silence, not an error" 0 "[]" \
     derives "$(files FLEET.md .github/workflows/ci.yml)"
 
+  # --- #302: one wrong answer and the surfaces the map never learned ------
+  # Every path asserted ALONE, per #300 round 1: a set holding a script and
+  # its test derives the scope when either row matches, so bundling would
+  # let a row be deleted with the case still green.
+
+  # D1, the reported bug replayed: both reconcilers source lib/attention.sh,
+  # nothing release-side does — [scope:release-flow] alone was a wrong
+  # answer, and the honest set is both, same as its two shelf-mates
+  check "derive: lib/attention.sh is release-flow AND labels" 0 \
+    "[scope:release-flow,scope:labels]" derives 'lib/attention.sh'
+
+  # D2: the sweep half of the automation, detached from the trigger half in
+  # #209 — cadence, permissions and job wiring must locate
+  check "derive: the labels sweep workflow is scope:labels" 0 \
+    "[scope:labels]" derives '.github/workflows/labels-sweep.yml'
+  check "derive: the self sweep workflow is scope:labels" 0 \
+    "[scope:labels]" derives '.github/workflows/self-labels-sweep.yml'
+
+  # D3, the deliberate asymmetry with D1: a test file inherits no lib/**
+  # glob, so its row is the one scope its subject actually locates
+  check "derive: attention's test is scope:labels alone" 0 \
+    "[scope:labels]" derives 'test/attention.test.sh'
+  check "derive: ruling's test is scope:labels alone" 0 \
+    "[scope:labels]" derives 'test/ruling.test.sh'
+
+  # D4: the same read's remaining gaps, one row each
+  check "derive: the trigger-surface pins are scope:labels" 0 \
+    "[scope:labels]" derives 'test/labels-triggers.test.sh'
+  check "derive: the assemble test is scope:release-flow" 0 \
+    "[scope:release-flow]" derives 'test/changelog-assemble.test.sh'
+  check "derive: the release-path manifest is scope:release-flow" 0 \
+    "[scope:release-flow]" derives '.github/scripts/release-path.sh'
+  check "derive: the release-path test is scope:release-flow" 0 \
+    "[scope:release-flow]" derives 'test/release-path.test.sh'
+  check "derive: the marker-check guard is scope:guards" 0 \
+    "[scope:guards]" derives '.github/scripts/marker-check.sh'
+  check "derive: the marker-check test is scope:guards" 0 \
+    "[scope:guards]" derives 'test/marker-check.test.sh'
+  check "derive: the vendored-check guard is scope:guards" 0 \
+    "[scope:guards]" derives '.github/scripts/vendored-check.sh'
+  check "derive: the vendored test is scope:guards" 0 \
+    "[scope:guards]" derives 'test/vendored.test.sh'
+
+  # D7: no test/** or .github/scripts/** catch-all — both directories span
+  # all four scopes, so this pair reds under any catch-all row: each file
+  # would gain the other's scope beside its own
+  check "derive: test/version.test.sh is release-flow alone" 0 \
+    "[scope:release-flow]" derives 'test/version.test.sh'
+  check "derive: this test file is scope:labels alone" 0 \
+    "[scope:labels]" derives 'test/labels-scope.test.sh'
+
   # refusals: unsupported shapes fail loudly, naming the label
   cat >"$TMP/allglobs.yml" <<'EOF'
 scope:x: