[Nitjsefnie]

Fixes #25321

Summary

The four remaining tree-scan pin tests handed git grep (or ls-files + grep) all of
packages/ and filtered to the files they judge afterwards, so a loaded runner paid for
hundreds of megabytes of non-source bytes per scan inside the pins' 60 s budget. This gives
each scan the pathspec of the extension it judges — the same shape PR #25319 used for the
runtime twin — so every pin judges the same file set while git reads only those files.

Changes

• packages/objectql/src/action-owner-key-single-source.test.ts: the three full-tree greps
  become one extension-scoped multi-needle scan shared by both tree assertions; stale-site
  line reporting and the release-record/pin exemptions are unchanged.
• packages/core/src/security/row-serving-door-exposure.pin.test.ts: one shared
  extension-scoped grep replaces the whole-tree scan; all matchers, comment filtering and
  caller classifications unchanged.
• packages/core/src/security/second-object-read-exposure.pin.test.ts: same shape; the
  arbiter prefilter, decision-site and wiring checks unchanged.
• packages/core/src/security/operation-private-keys.pin.test.ts: the content prefilter
  becomes one extension-scoped grep that includes .tsx on purpose, so the existing
  excluded-.tsx-declaration boundary assertion keeps its own discriminating population;
  the ordinary offender set stays .ts minus .d.ts, and the filename-only ls-files
  exclusion census is untouched.
• packages/core/src/security/granted-permissions-not-enforced.pin.test.ts already scopes
  its pathspecs (.ts/.mts) and is left unchanged.
• Every SCAN_TIMEOUT_MS = 60_000 is byte-identical to before: this is not a timeout
  raise. Ablation checks confirm each edited pin still goes red on a planted violation in
  a still-scanned path, and that the excluded-.tsx boundary assertion still fires on a
  planted excluded declaration.

Testing

• The four edited pins pass locally (objectql 5/5; row-serving 3/3; second-object 4/4;
  operation-private-keys 5/5).
• Per-scanner ablations: a planted offending declaration/call in a still-scanned .ts
  path turns each pin red with its own assertion failure and is restored to green; a
  planted declaration in an excluded .tsx file still turns the boundary assertion red
  while the ordinary offender assertion stays green.
• Narrow ESLint over the touched files: clean.
• Full CI (build, sharded tests, docs, lint, typecheck) runs on this branch.

Tests-only change: per .github/workflows/pr-automation.yml the diff releases nothing, so
it is eligible for the skip-changeset exemption label — applying labels is not something
a fork PR can do for itself.

Authored by automated coding agents; per-commit authorship is recorded in the commits'
Co-Authored-By trailers.

[Nitjsefnie]

Heads-up: this branch lives in an organization-owned fork, and GitHub doesn't let maintainers push to those. If anything needs changing, just say so here and I'll make the change on this branch right away.

[objectstack-fleet]

Thank you, @Nitjsefnie — this is a good fix, and it has been adopted as proposed. This repository works card-first and never lands a fork pull request directly (external contributions ③), so your diff was re-committed on the internal branch of #25410 with Co-authored-by: Nitjsefnie, plus one follow-up that gives the objectql twin the runtime twin's one-scan shape. #25321 closes when #25410 lands.

Closing this one now because the Duplicate Fix Guard lets only one open pull request declare #25321. Your authorship is in the commit.

---

Generated by Claude Code