@@ -69,19 +69,18 @@
  * identifiers as FIXED STRINGS, which is a provably exact superset of what
  * `declarationMatcher()` can match (the regex cannot match text that lacks the literal
  * identifier), so no judgement moves into git's regex dialect — the JS regex
- * below remains the sole authority on what counts as a declaration. Reading only
- * the handful of files that mention a symbol, rather than all ~3,600, is also
- * what removes the timeout exposure: one `git grep` process instead of ~3,600
- * sequential `readFileSync` round-trips, which is the part that degrades
- * non-linearly when a runner is I/O-saturated.
+ * below remains the sole authority on what counts as a declaration. One
+ * extension-scoped `git grep` supplies the shared prefilter result; only files
+ * that mention a symbol are read for declaration matching. The scan hook's
+ * budget still applies when the runner is busy.
  */
 
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { describe, it, expect } from 'vitest';
+import { beforeAll, describe, it, expect } from 'vitest';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 /** …/packages/core/src/security → repo root */
@@ -111,7 +110,7 @@ const HELPER_SYMBOL = 'withoutOperationPrivateKeys';
  * a docblock line begins with ` * `, and a string-literal or regex-source line
  * begins with something other than `const`/`let`/`var`/`function` followed by a
  * guarded name. That property is load-bearing, so it is asserted rather than
- * trusted — see the last test.
+ * trusted — see "this pin quotes both symbols without declaring them".
  *
  * Returned as a FRESH regex per call, never shared. A `/g` regex carries
  * `lastIndex` across calls, so one shared instance makes the result depend on
@@ -125,11 +124,10 @@ const declarationMatcher = (): RegExp =>
   /^\s*(?:export\s+)?(?:const|let|var|function)\s+(OPERATION_PRIVATE_KEY_PREFIX|withoutOperationPrivateKeys)\b\s*[=(<]/gm;
 
 /**
- * Generous on purpose (#7706). The scan costs tens of milliseconds, so this is
- * not a budget — it is headroom against a merge-queue runner that is doing a
- * full monorepo build at the same time. The default 5s was the whole failure:
- * the pin timed out before the assertion ran, and a pin that reports nothing is
- * indistinguishable from a pin that found nothing.
+ * The scan hook's budget includes headroom for a merge-queue runner doing a
+ * full monorepo build at the same time. The earlier filesystem crawl (#7706)
+ * timed out under the default test budget before its assertion ran. A pin that
+ * reports nothing is indistinguishable from a pin that found nothing.
  */
 const SCAN_TIMEOUT_MS = 60_000;
 
@@ -235,13 +233,12 @@ function scannedFiles(): string[] {
 }
 
 /**
- * Every path the fixed-string prefilter returns, BEFORE the extension boundary
- * — so it includes the `.tsx` (and `.md`, and config) files the scan does not
- * judge. Split out for the same reason as `authoredPaths()`: the trade the
- * boundary rests on is a claim about the files it drops, and a claim about
- * dropped files cannot be made from the set they were dropped from.
+ * The fixed-string prefilter covers `.ts` for the offender scan AND `.tsx`
+ * for the boundary-expiry assertion. Other extensions feed neither judgement,
+ * so git need not read their bytes. The `.tsx` hits must stay available before
+ * `isScannedSource` drops them from the offender population.
  */
-function prefilterHits(): string[] {
+function scanTree(): string[] {
   return git([
     'grep',
     '--files-with-matches',
@@ -254,7 +251,8 @@ function prefilterHits(): string[] {
     '-e',
     HELPER_SYMBOL,
     '--',
-    'packages',
+    ':(glob)packages/**/*.ts',
+    ':(glob)packages/**/*.tsx',
   ]);
 }
 
@@ -273,7 +271,18 @@ function declaringFiles(): string[] {
   );
 }
 
+/** One prefilter result shared by the offender, reach and boundary assertions. */
+let treeMentions: string[];
+
+function prefilterHits(): string[] {
+  return treeMentions;
+}
+
 describe('the `__` operation-private-key convention has one owner (#7284)', () => {
+  beforeAll(() => {
+    treeMentions = scanTree();
+  }, SCAN_TIMEOUT_MS);
+
   it(
     'is declared in exactly one file, and that file is the shared home',
     () => {
 
@@ -47,7 +47,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { describe, it, expect } from 'vitest';
+import { beforeAll, describe, it, expect } from 'vitest';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 /** …/packages/core/src/security → repo root */
@@ -132,16 +132,27 @@ const codeLines = (file: string) =>
 const calls = (file: string, matcher: () => RegExp) => codeLines(file).some((line) => matcher().test(line));
 
 /** Fixed-string prefilter over tracked plus untracked sources; the regex decides. */
-function filesMentioningTheAdmission(): string[] {
-  return git(['grep', '--files-with-matches', '-z', '--untracked', '--fixed-strings', '-e', ADMISSION, '--', 'packages'])
+function scanTree(): string[] {
+  return git(['grep', '--files-with-matches', '-z', '--untracked', '--fixed-strings', '-e', ADMISSION, '--', ':(glob)packages/**/*.ts'])
     .filter(isScannedSource);
 }
 
 function admissionCallers(): string[] {
   return filesMentioningTheAdmission().filter((file) => calls(file, admissionCall)).sort();
 }
 
+/** Shared by the census and its reach control; each file pays for one grep. */
+let treeMentions: string[];
+
+function filesMentioningTheAdmission(): string[] {
+  return treeMentions;
+}
+
 describe('[#22640] every row-serving door outside the data routes asks the exposure decision', () => {
+  beforeAll(() => {
+    treeMentions = scanTree();
+  }, SCAN_TIMEOUT_MS);
+
   it(
     'every caller of the read admission is classified, and every classified file still calls it',
     () => {
 
@@ -75,7 +75,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { describe, it, expect } from 'vitest';
+import { beforeAll, describe, it, expect } from 'vitest';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 /** …/packages/core/src/security → repo root */
@@ -272,8 +272,8 @@ const codeLines = (file: string) =>
 const callsArbiter = (file: string) => codeLines(file).some(arbiterCall);
 
 /** Fixed-string prefilter over tracked plus untracked sources; the matcher decides. */
-function filesMentioningTheArbiter(): string[] {
-  return git(['grep', '--files-with-matches', '-z', '--untracked', '--fixed-strings', '-e', ARBITER, '--', 'packages'])
+function scanTree(): string[] {
+  return git(['grep', '--files-with-matches', '-z', '--untracked', '--fixed-strings', '-e', ARBITER, '--', ':(glob)packages/**/*.ts'])
     .filter(isScannedSource);
 }
 
@@ -306,7 +306,18 @@ function functionBody(file: string, fn: string): string[] {
   return body;
 }
 
+/** Shared by the census and its reach control; each file pays for one grep. */
+let treeMentions: string[];
+
+function filesMentioningTheArbiter(): string[] {
+  return treeMentions;
+}
+
 describe('[#22661] every read that reaches a second object asks that object its exposure, or is named', () => {
+  beforeAll(() => {
+    treeMentions = scanTree();
+  }, SCAN_TIMEOUT_MS);
+
   it(
     'every caller of the reference-target arbiter is classified, and every classified file still calls it',
     () => {
 
@@ -20,7 +20,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { describe, it, expect } from 'vitest';
+import { beforeAll, describe, it, expect } from 'vitest';
 import { GLOBAL_ACTION_OBJECT_KEY, standaloneActionOwnerKey } from './action-governance.js';
 
 /** Rung 1 exactly as `action-governance.ts` writes it. */
@@ -264,11 +264,34 @@ const SCANNED_ROOTS: readonly string[] = ['packages'];
 const SCANNED_EXTENSION = '.ts';
 
 /**
- * Generous on purpose. The scan is one `git grep` and a handful of file reads —
- * tens of milliseconds — so this is not a budget, it is headroom against a
- * merge-queue runner doing a full monorepo build at the same time. A pin that
- * times out before its assertion runs reports nothing, and reporting nothing is
- * indistinguishable from finding nothing.
+ * The scanned roots as git pathspecs: every `SCANNED_EXTENSION` file at any
+ * depth under each root, which is the very glob this package declares in
+ * `scripts/cross-package-test-inputs.mjs`. Handed to git rather than applied to
+ * its answer, so git reads only the files the scan judges. The set is the one
+ * the `.endsWith('.ts')` filter on git's output used to keep, file for file, so
+ * nothing the scan proves narrows; what changes is that the other quarter of
+ * the bytes under `packages/` (the `CHANGELOG.md`s alone are 55 MB) is no
+ * longer read just to be thrown away.
+ *
+ * The `glob` magic is spelled out so `GIT_GLOB_PATHSPECS` and
+ * `GIT_NOGLOB_PATHSPECS` cannot change what it matches. A setting that turns
+ * pathspec magic off altogether makes the scan match nothing, and the reach
+ * control below reds on that.
+ */
+const SCANNED_PATHSPECS: readonly string[] = SCANNED_ROOTS.map(
+    (root) => `:(glob)${root}/**/*${SCANNED_EXTENSION}`,
+);
+
+/**
+ * The budget of the one tree scan, which `beforeAll` runs (see `scanTree`).
+ * Generous on purpose: the scan is one `git grep` and a handful of file reads,
+ * so this is headroom against a merge-queue runner doing a full monorepo build
+ * at the same time. A pin that times out before its assertion runs reports
+ * nothing, and reporting nothing is indistinguishable from finding nothing.
+ *
+ * ⛔ Not a dial. When a loaded runner pushes the scan toward this figure, cut
+ * the bytes the scan reads; raising the figure only lets a slower scan hide
+ * for longer.
  */
 const SCAN_TIMEOUT_MS = 60_000;
 
@@ -290,43 +313,102 @@ function git(args: string[]): string[] {
     return stdout.split('\0').filter((entry) => entry.length > 0);
 }
 
+/** Every symbol the tree scan asks about: the dead member, and the reach control's live spelling. */
+const HUNTED_SYMBOLS: readonly string[] = [DELETED_PLUGIN_MEMBER, CANONICAL_HELPER];
+
+/** Per hunted symbol: every scanned file that mentions it, with the 1-based lines that do. */
+type TreeScan = ReadonlyMap<string, ReadonlyMap<string, readonly number[]>>;
+
 /**
- * Every scanned file that so much as mentions `symbol`.
+ * ONE walk of the scanned tree answers every question the tree tests ask.
  *
- * Tracked files PLUS untracked ones with ignored paths excluded (`--untracked`)
- * — i.e. exactly the files a human authored, never build output. A file written
- * but not yet `git add`ed still reddens, which is what makes this a local-loop
- * guard rather than something you find out about in the merge queue.
+ * Each question used to pay its own walk: three `git grep`s per run, each
+ * reading every file under `packages/`, 3 × 213.2 MB. On a quiet machine that
+ * is a fraction of a second; on the most loaded Test Core shard the runtime
+ * twin of this file took 86.24 s against the same 60 s budget. A tree scan
+ * costs the bytes it reads, and the bytes are what a loaded runner slows, so
+ * the remedy is fewer bytes: one `git grep` for every hunted symbol at once,
+ * over `SCANNED_PATHSPECS`, is 151.8 MB, four times less (both measured with
+ * the scan's own arguments at 830a63a). Reading it once also tightens the
+ * reach control, which now proves the very scan whose emptiness the first test
+ * reads, not a sibling run of it.
+ *
+ * Scans tracked files PLUS untracked ones with ignored paths excluded
+ * (`--untracked`): exactly the files a human authored, never build output. A
+ * file written but not yet `git add`ed still reddens, which keeps this a
+ * local-loop guard.
  */
-function filesMentioning(symbol: string): string[] {
-    return git([
+function scanTree(): TreeScan {
+    const candidates = git([
         'grep',
         '--files-with-matches',
         '-z',
         '--untracked',
         '--text',
         '--fixed-strings',
-        '-e',
-        symbol,
+        ...HUNTED_SYMBOLS.flatMap((symbol) => ['-e', symbol]),
         '--',
-        ...SCANNED_ROOTS,
-    ]).filter((file) => file.endsWith(SCANNED_EXTENSION));
+        ...SCANNED_PATHSPECS,
+    ]);
+    const scan = new Map<string, Map<string, number[]>>();
+    for (const symbol of HUNTED_SYMBOLS) scan.set(symbol, new Map());
+    for (const file of candidates) {
+        const lines = readFileSync(join(REPO_ROOT, file), 'utf8').split('\n');
+        let attributed = false;
+        for (const [symbol, files] of scan) {
+            const hits = lines.flatMap((text, index) => (text.includes(symbol) ? [index + 1] : []));
+            if (hits.length === 0) continue;
+            files.set(file, hits);
+            attributed = true;
+        }
+        // git matched this file, so a read that finds none of the needles
+        // means the two disagree about its bytes: a broken scan, never a clean
+        // file.
+        if (!attributed) {
+            throw new Error(
+                `git grep listed ${file} as mentioning one of ${HUNTED_SYMBOLS.join(', ')}, `
+                + 'and reading it finds none of them.',
+            );
+        }
+    }
+    return scan;
+}
+
+/** Filled by the tree tests' `beforeAll`; read by both of them. */
+let treeScan: TreeScan | undefined;
+
+function mentionsOf(symbol: string): ReadonlyMap<string, readonly number[]> {
+    const mentions = treeScan?.get(symbol);
+    if (!mentions) {
+        throw new Error(
+            treeScan
+                ? `${symbol} is not one of the symbols the tree scan hunts (HUNTED_SYMBOLS).`
+                : 'A tree test read the tree scan before its beforeAll ran it.',
+        );
+    }
+    return mentions;
+}
+
+/** Every scanned file that so much as mentions `symbol`. */
+function filesMentioning(symbol: string): string[] {
+    return [...mentionsOf(symbol).keys()];
 }
 
 /** `<file>:<line>` for every mention that no rule above excuses. */
 function staleMentionSites(symbol: string): string[] {
     const sites: string[] = [];
-    for (const file of filesMentioning(symbol)) {
+    for (const [file, lines] of mentionsOf(symbol)) {
         if (NOT_A_STALE_MENTION.some((rule) => rule.covers(file))) continue;
-        const lines = readFileSync(join(REPO_ROOT, file), 'utf8').split('\n');
-        lines.forEach((text, index) => {
-            if (text.includes(symbol)) sites.push(`${file}:${index + 1}`);
-        });
+        for (const line of lines) sites.push(`${file}:${line}`);
     }
     return sites;
 }
 
 describe('standalone-action owner key — the deleted member is dead TREE-WIDE (#14878)', () => {
+    beforeAll(() => {
+        treeScan = scanTree();
+    }, SCAN_TIMEOUT_MS);
+
     it(
         'is named nowhere outside the release record and the two pins',
         () => {
@@ -356,7 +438,6 @@ describe('standalone-action owner key — the deleted member is dead TREE-WIDE (
                       ].join('\n'),
             ).toEqual([]);
         },
-        SCAN_TIMEOUT_MS,
     );
 
     it(
@@ -380,6 +461,5 @@ describe('standalone-action owner key — the deleted member is dead TREE-WIDE (
             expect(reached).toContain('packages/cli/src/commands/lint.ts');
             expect(reached).toContain('packages/runtime/src/action-execution.ts');
         },
-        SCAN_TIMEOUT_MS,
     );
 });