diff --git a/.github/codeql/production.yml b/.github/codeql/production.yml
index 2fbd5e5171..f96a1c7609 100644
--- a/.github/codeql/production.yml
+++ b/.github/codeql/production.yml
@@ -3,6 +3,12 @@ name: REA production code
 # Match the existing default-setup scan's local-input threat model.
 threat-models: [local]
 
+# Retain root traversal, including future production roots. Hidden directories
+# need their own root; use a directory so Python can share this configuration.
+paths:
+  - .
+  - docs/.vitepress
+
 # Keep the default query suite and all production roots, including bridge/,
 # install.sh, runtime scripts, release controllers, and GitHub Actions.
 # Exclude test inputs at extraction time so they cannot taint production callers.
diff --git a/docs/testing.md b/docs/testing.md
index 3b13ad19c3..6db48f08ce 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -374,6 +374,11 @@ threat model. Production source, bridges, runtime scripts, installation and
 release controllers, and Actions remain in scope for the configured languages.
 Verification scripts remain included unless they match an explicit test path;
 excluding the entire `scripts/` directory would hide shipped entrypoints.
+The `paths` list retains repository-root traversal and explicitly includes
+`docs/.vitepress/`, which JavaScript extraction otherwise skips as a hidden
+directory. Keep directory entries here: the shared Python extractor does not
+accept individual files as traversal roots. When changing this list, compare the
+complete production file inventory as well as alert counts.
 These exclusions do not change which behavioral tests CI executes. CodeQL's
 JavaScript/TypeScript, Python, and Actions lanes do not add shell, Java, or Swift
 analysis; their existing checks remain responsible for those languages.
@@ -390,7 +395,7 @@ default setup in this user-owned repository.
 Each analysis uses two threads and a 4096 MiB CodeQL memory budget; language
 jobs run one at a time. Complete SARIF reports are retained for seven days.
 For a scope comparison, use the same source SHA, CodeQL bundle, default query
-suite, and `local` threat model on both runs. Change only `paths-ignore`, inspect
+suite, and `local` threat model on both runs. Change only extraction paths, inspect
 the extracted-file inventory and diagnostics, and retain both complete reports.
 Alert counts do not establish a false-positive rate or a speedup. Report elapsed
 time, CPU time, and process-family memory with their measurement limits.
diff --git a/tests/boundary/filesystem/ciCodeqlScope.test.ts b/tests/boundary/filesystem/ciCodeqlScope.test.ts
index 4813412d49..0374672db7 100644
--- a/tests/boundary/filesystem/ciCodeqlScope.test.ts
+++ b/tests/boundary/filesystem/ciCodeqlScope.test.ts
@@ -9,6 +9,7 @@ const configuration = z
   .strictObject({
     name: z.string(),
     "threat-models": z.array(z.string()),
+    paths: z.array(z.string()),
     "paths-ignore": z.array(z.string()),
   })
   .parse(
@@ -54,6 +55,7 @@ it.each([
   "scripts/verify-package-install.mjs",
   "scripts/verify-package-update.mjs",
   "scripts/verify-windows-native-artifact.mjs",
+  "docs/.vitepress/config.ts",
   ".github/workflows/release.yml",
   ".github/actions/publish-mcp/action.yml",
 ])("retains production or release input %s", (path) => {
@@ -73,6 +75,10 @@ it("retains all packaged entrypoints and the existing local-input threat model",
     );
   expect(manifest.files.filter(excluded)).toEqual([]);
   expect(configuration["threat-models"]).toEqual(["local"]);
+  // A narrow allowlist would silently drop new production roots. Explicitly
+  // traverse the hidden configuration directory without excluding the root.
+  expect(configuration.paths).toContain(".");
+  expect(configuration.paths).toContain("docs/.vitepress");
 });
 
 it("uses the scope in a bounded workflow gated on administrator activation", async () => {