diff --git a/codecov.yml b/codecov.yml
index 4f1e106..4e40441 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -9,3 +9,10 @@ coverage:
       default:
         target: 90%
         threshold: 5%
+
+# Mirror sonar.coverage.exclusions (sonar-project.properties): exclude the same
+# path from Codecov's coverage denominator so both tools measure the identical
+# scope. Without this, Codecov counts agent_assembly/types.py while SonarCloud
+# does not, producing a spurious cross-tool coverage delta (AAASM-3962).
+ignore:
+  - "agent_assembly/types.py"
diff --git a/sonar-project.properties b/sonar-project.properties
index df089de..d117c69 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -20,12 +20,19 @@ sonar.sources=agent_assembly/
 sonar.tests=test/
 
 # Python test coverage settings
+# SonarCloud and Codecov consume the SAME coverage report set: the pytest-cov
+# `coverage_*.xml` files produced from `.coveragerc`. SonarCloud globs them via
+# reportPaths below (in CI it scans the downloaded `coverage_all-test.xml`);
+# Codecov uploads the same per-suite files. Both are fed one coverage source,
+# so any residual percentage delta is engine-level (SonarCloud's analyzer vs
+# coverage.py line counting), not a scope mismatch or regression (AAASM-3962).
 sonar.python.file.suffixes=.py
 sonar.python.version=3.12,3.13
 sonar.python.coverage.reportPaths=coverage*.xml
 #sonar.coverage.python.reportPaths=coverage*.xml
 
-# Ignore by test coverage
+# Ignore by test coverage. Kept in lockstep with the `ignore` list in
+# codecov.yml so both tools exclude the same paths from their denominator.
 sonar.coverage.exclusions=agent_assembly/types.py
 
 # Ignore by general analyze