diff --git a/dankclaw/udev/99-comfyui-gpu-access.rules b/dankclaw/udev/99-comfyui-gpu-access.rules
index b79c78d..df3a895 100644
--- a/dankclaw/udev/99-comfyui-gpu-access.rules
+++ b/dankclaw/udev/99-comfyui-gpu-access.rules
@@ -15,7 +15,7 @@
 # domain) can already ptrace the GPU userspace through an existing holder's
 # fd inheritance; on a private single-administrator home server this trades a
 # capability gate that could never be held by the intended user anyway.
-# Render nodes and /dev/kfd are compute nodes only — display outputs (card0,
-# card1) keep their owner/group/mode.
-KERNEL=="kfd", SUBSYSTEM=="misc", MODE="0666"
+# Note the missing SUBSYSTEM= guard on the kfd line: misc-class devices have no
+# subsystem for udev matching, so a SUBSYSTEM=="misc" guard never matches.
+KERNEL=="kfd", MODE="0666"
 KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0666"
diff --git a/scripts/test-changed.sh b/scripts/test-changed.sh
index 4cf3fa5..ddbc62b 100755
--- a/scripts/test-changed.sh
+++ b/scripts/test-changed.sh
@@ -214,6 +214,10 @@ for path in "${CHANGED[@]}"; do
     esac
 done
 
+# Mapped-but-untestable paths (udev rules, trash moves) legitimately produce an
+# empty selection; that is a pass, not a bats usage error.
+[ "${#TESTS[@]}" -gt 0 ] || exit 0
+
 if [ "$LIST_ONLY" -eq 1 ]; then
     printf '%s\n' "${TESTS[@]}"
     exit 0