A constraint declares what KIND of thing its scope names — `subject` separates unaddressable from undeclared, and the coverage report stops counting them as one defect

Asked 'what governs this file?', an agent answers from whatever a keyword matched.