diff --git a/docs/linuxcnc-source-policy.md b/docs/linuxcnc-source-policy.md
index 3ebc450..efa8ed9 100644
--- a/docs/linuxcnc-source-policy.md
+++ b/docs/linuxcnc-source-policy.md
@@ -114,6 +114,13 @@ Efficiency rules:
   generated table/case outputs, and the thin API/web bridge files that pass
   switchkins config aliases. Native, source-link, and build-wasm entry points
   must run this cached check before consuming those aliases.
+- The switchkins/remap generator must treat LinuxCNC `[EMCIO] TOOL_TABLE`
+  entries as source coverage only. Resolvable tool tables referenced by
+  M428/M429/M430 INI files must be present as `tooldata` manifest entries and
+  must not become new generated API aliases or browser cases.
+- The kinematics manifest lister must preserve every allowed manifest group
+  used by switchkins and RTCP coverage, including `asset`, `tooldata`, and
+  `generated`, and must reject unknown filters or output modes for those groups.
 - Reuse wasm probe objects across the wasm source object probe,
   `rs274ngc_pre` blocker/link probes, and the runtime link probe through
   `build-linuxcnc-wasm-probe-objects.sh`. Its mode-specific object caches must
@@ -294,7 +301,8 @@ Build and source-link guardrails:
 - The default wasm manifest partition must remain explicitly checked for 26
   wasm-safe core sources and 9 blocked sources.
 - Manifest source listers must reject malformed lines, absolute source paths,
-  unknown groups, unknown filters, and duplicate source entries.
+  unknown groups, unknown filters, unknown output modes, and duplicate source
+  entries.
 - Native link flags must include the built LinuxCNC `lib` path and rpath.
 - Common CXX flag helpers must surface helper failures instead of hiding them
   behind process substitution or `read`.
diff --git a/test-all-native.sh b/test-all-native.sh
index 217c7ee..3d544bb 100755
--- a/test-all-native.sh
+++ b/test-all-native.sh
@@ -110,6 +110,10 @@ grep -F 'web/src/wasm-core.js' check-linuxcnc-switchkins-remap-table-cached.sh >
 grep -F 'the cached wrapper script, checker script, generator script' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'generated table/case outputs, and the thin API/web bridge files that pass' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'switchkins config aliases.' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'The switchkins/remap generator must treat LinuxCNC `[EMCIO] TOOL_TABLE`' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'must not become new generated API aliases or browser cases.' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'The kinematics manifest lister must preserve every allowed manifest group' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'including `asset`, `tooldata`, and' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'check-linuxcnc-switchkins-remap-table-cached.sh --cache-dir "$preflight_cache_dir" linuxcnc-kinematics-source-files.txt' test-native.sh >/dev/null
 grep -F 'check-linuxcnc-switchkins-remap-table-cached.sh --cache-dir "$preflight_cache_dir" linuxcnc-kinematics-source-files.txt' test-linuxcnc-source-link.sh >/dev/null
 grep -F 'check-linuxcnc-switchkins-remap-table-cached.sh --cache-dir "$preflight_cache_dir" linuxcnc-kinematics-source-files.txt' build-wasm.sh >/dev/null
@@ -551,6 +555,7 @@ grep -F 'test-web-wasm-node-smoke.sh' docs/linuxcnc-porting.md >/dev/null
 grep -F 'explicitly checked for 26' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'wasm-safe core sources and 9 blocked sources' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'must reject malformed lines, absolute source paths,' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'unknown groups, unknown filters, unknown output modes, and duplicate source' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'must include the built LinuxCNC `lib` path and rpath' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'must surface helper failures instead of hiding them' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'Temporary probe reports must be cleaned on failure' docs/linuxcnc-source-policy.md >/dev/null