diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index e4094a82..0b1550b8 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -10,11 +10,8 @@ on:
     branches:
       - main
 
-# Stated, not inherited: paths-filter needs `pull-requests: read`, and naming
-# any permission drops the rest to none.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   lint_and_test:
@@ -47,85 +44,22 @@ jobs:
           pnpm install
           echo "$(pwd)/node_modules/.bin" >> $GITHUB_PATH
 
-      # No build step. `nps build` runs Jekyll over doc/, which wants a Ruby
-      # toolchain that nothing below reads the output of -- the checks read
-      # the sources.
+      # No build step: there is nothing to build. The checks read the sources.
 
-      # Checks to see if any files in the PR match one of the listed file types.
-      # We can use this filter to decide whether or not to run linters or tests.
-      # You can check if a file with a listed file type is in the PR by doing:
-      # if: ${{ steps.filter.outputs.md == 'true' }}
-      # This will return true if there's a Markdown file the PR has changed.
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
-        id: filter
-        with:
-          filters: |
-            dockerfile:
-              - '**/Dockerfile'
-            js:
-              - '**/*.js'
-              - '**/*.mjs'
-            json:
-              - '**/*.json'
-              - '**/*.json5'
-              - '**/*.jsonc'
-            liquid:
-              - '**/*.html'
-              - '**/*.liquid'
-            md:
-              - '**/*.md'
-            toml:
-              - '**/*.toml'
-            ts:
-              - '**/*.ts'
-              - '**/*.mts'
-            yaml:
-              - '**/*.yml'
-              - '**/*.yaml'
-
-      # Not behind a filter: every pull request has commit messages, whatever
-      # it touches.
-      - name: Verify commit messages
-        run: nps verify.commits
-
-      # Use the filter to check if files with a specific file type were changed
-      # in the PR. If they were, run the relevant linters. Otherwise, skip.
-      - name: Verify Dockerfile
-        if: ${{ steps.filter.outputs.dockerfile == 'true' }}
-        run: nps verify.dockerfile
-
-      - name: Verify JavaScript
-        if: ${{ steps.filter.outputs.js == 'true' }}
-        run: nps verify.js
-
-      - name: Verify JSON
-        if: ${{ steps.filter.outputs.json == 'true' }}
-        run: nps verify.json
-
-      - name: Verify Liquid
-        if: ${{ steps.filter.outputs.liquid == 'true' }}
-        run: nps verify.liquid
-
-      - name: Verify Markdown
-        if: ${{ steps.filter.outputs.md == 'true' }}
-        run: nps verify.md
-
-      - name: Verify TOML
-        if: ${{ steps.filter.outputs.toml == 'true' }}
-        run: nps verify.toml
-
-      - name: Verify TypeScript
-        if: ${{ steps.filter.outputs.ts == 'true' }}
-        run: nps verify.ts
-
-      - name: Verify YAML
-        if: ${{ steps.filter.outputs.yaml == 'true' }}
-        run: nps verify.yaml
-
-      # Only run tests if the PR touches behavior-related files. On main
-      # everything runs, since nothing else checks what landed.
+      # Everything, on every pull request, rather than a per-language subset
+      # chosen by which files changed.
+      #
+      # The subset was chosen by a paths filter, and the tasks that belong to
+      # no language -- spelling, filenames, file modes, EditorConfig, the unit
+      # tests -- sat behind the same gate as the ones that do. A pull request
+      # touching only Markdown skipped all five, so a misspelling could land
+      # green and turn main red on the push that followed it, which is the one
+      # place nothing is watching.
+      #
+      # Filtering bought six seconds: an 18-second run against a 24-second one,
+      # both of them mostly checkout, node and install. That is not worth a
+      # class of change that passes review and breaks the branch it lands on.
       - name: Test
-        if: ${{ github.event_name == 'push' || steps.filter.outputs.js == 'true' || steps.filter.outputs.json == 'true' || steps.filter.outputs.ts == 'true' }}
         # verify.validForEC fetches the editorconfig-checker binary from the
         # GitHub API on first use, and node_modules is new on every run here.
         # Unauthenticated that is 60 requests an hour shared with every other