diff --git a/sonar-project.properties b/sonar-project.properties
index 25af293be..b70c88cc2 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -6,7 +6,8 @@ sonar.sourceEncoding=UTF-8
 sonar.sources=client/src,server/src,shared/src,plugin-sdk/src
 
 # Tests — dedicated test dirs per package, plus co-located client tests in src
-sonar.tests=server/tests,client/tests,client/e2e,client/src,plugin-sdk/test
+# and co-located shared schema/sanitize/i18n specs in shared/src
+sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
 sonar.test.inclusions=\
    server/tests/**/*.test.ts,\
    client/tests/**/*.test.ts,\
@@ -14,6 +15,7 @@ sonar.test.inclusions=\
    client/e2e/**/*.spec.ts,\
    client/src/**/*.test.ts,\
    client/src/**/*.test.tsx,\
+   shared/src/**/*.spec.ts,\
    plugin-sdk/test/**/*.test.ts
 
 # Keep generated output and test files out of source analysis
@@ -25,10 +27,12 @@ sonar.exclusions=\
    client/dev-dist/**,\
    **/*.test.ts,\
    **/*.test.tsx,\
+   **/*.spec.ts,\
    **/*.d.ts
 
 # Coverage — lcov paths relative to repo root.
-# shared/ has no tests yet and plugin-sdk doesn't emit lcov; see coverage exclusions.
+# shared/ and plugin-sdk/ have test suites but don't emit lcov (no coverage
+# reporter configured); their sources are coverage-excluded below until they do.
 sonar.javascript.lcov.reportPaths=\
    server/coverage/lcov.info,\
    client/coverage/lcov.info
@@ -37,7 +41,6 @@ sonar.javascript.lcov.reportPaths=\
 sonar.coverage.exclusions=\
    server/src/index.ts,\
    server/src/config.ts,\
-   server/src/scheduler.ts,\
    server/src/db/database.ts,\
    server/src/db/migrations.ts,\
    server/src/db/seeds.ts,\