@@ -14,12 +14,30 @@
       },
       {
         "id": "engine",
-        "paths": [".codebase-memory.json", "src/mcp/test_impact*", "src/store/store_impact.*"],
+        "paths": [
+          ".codebase-memory.json",
+          "src/mcp/test_impact*",
+          "src/store/store_impact.*",
+          "scripts/test-impact/**",
+          "scripts/ci/test-impact-*"
+        ],
         "action": "run_all"
       },
       {
         "id": "build",
-        "paths": ["scripts/**", "test-infrastructure/**", "pkg/**"],
+        "paths": [
+          "scripts/build.sh",
+          "scripts/env.sh",
+          "scripts/test.sh",
+          "scripts/run-tests-parallel.sh",
+          "scripts/run-test-wave.py",
+          "scripts/path-safety.sh",
+          "scripts/clean.sh",
+          "scripts/suite-failure-report.sh",
+          "scripts/ci/verify-shard-union.sh",
+          "scripts/embed-frontend.sh",
+          "/.gitattributes"
+        ],
         "action": "run_all"
       },
       {
@@ -35,13 +53,31 @@
       },
       {
         "id": "contracts",
-        "paths": ["tests/**/*.{sh,py,json,txt}"],
+        "paths": ["tests/**/*.{sh,py,json,txt,ps1}"],
         "action": "ignore"
       },
       {
         "id": "notices",
         "paths": ["NOTICE*", "CHANGELOG*", "THIRD_PARTY*"],
         "action": "ignore"
+      },
+      {
+        "id": "repo-data",
+        "paths": [
+          "scripts/**",
+          "pkg/**",
+          "test-infrastructure/**",
+          "docs/**",
+          "**/*.md",
+          "graph-ui/**",
+          "tools/**",
+          "tests/fuzz/corpus/**",
+          "/{.clang-format,.clang-tidy,.cppcheck,.gitignore,.gitleaksignore,DCO,Formula}",
+          "/{flake.lock,flake.nix,glama.json,install.ps1,install.sh,server.json}"
+        ],
+        "action": "referencing_tests",
+        "key": "path",
+        "unreferenced": "ignore"
       }
     ],
     "unmapped_files": "run_all",
 
@@ -0,0 +1,5 @@
+# Constraints for the ScanCode install of the license gate (PIP_CONSTRAINT).
+# pluggy 1.7.0 (2026-10-15) no longer finds plugincode 32.0.0's class-level
+# hookspecs: scancode then crashes at import with "did not find any
+# 'pre_scan' hooks" and the gate fails on every run.
+pluggy==1.6.0
@@ -23,8 +23,11 @@ jobs:
     runs-on: ubuntu-24.04
     # 15 min proved too tight on a slow runner day and a timed-out lint reads
     # as "cancelled", which the release graph must treat as a hard stop; keep
-    # a bound, but one only a genuine hang can hit (normal runtime ~5 min).
-    timeout-minutes: 30
+    # a bound, but one only a genuine hang can hit. 30 min stopped being that
+    # in 2026-10: single-process cppcheck over a src tree that grew ~60 % in
+    # files took the lint step from ~8 to 22-29 min, and three runs on
+    # 2026-10-13 were cancelled at 30 min with cppcheck still alive.
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
 
@@ -21,9 +21,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: "Layer 1: Static allow-list audit"
-        run: scripts/security-audit.sh
+        run: |
+          bash tests/test_security_audit_subprocess_calls.sh
+          scripts/security-audit.sh
       - name: "Layer 6: UI security audit"
-        run: scripts/security-ui.sh
+        run: |
+          bash tests/test_security_ui_urls.sh
+          scripts/security-ui.sh
       - name: "Layer 8: Vendored dependency integrity"
         run: scripts/security-vendored.sh
 
@@ -34,7 +38,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install ScanCode Toolkit
-        run: pipx install scancode-toolkit
+        # Pinned: an unpinned install picked up pluggy 1.7.0, which breaks
+        # scancode at import (see .github/scancode-constraints.txt).
+        env:
+          PIP_CONSTRAINT: ${{ github.workspace }}/.github/scancode-constraints.txt
+        run: pipx install scancode-toolkit==32.5.0
       - name: "Gate self-test (a planted violation must be detected)"
         run: scripts/license-gate.sh --selftest
       - name: "License compliance gate (one finding fails)"
 
@@ -95,6 +95,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # macOS runner images have none on PATH.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
@@ -118,6 +125,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       - name: Security audits
         run: |
@@ -175,6 +183,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper; the
+      # MSYS2 shell below inherits it (path-type: inherit).
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }}
@@ -224,6 +239,7 @@ jobs:
         env:
           SMOKE_ARCH: ${{ matrix.arch }}
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
         run: |
           export CBM_SMOKE_ARTIFACT_DIR="$(cygpath -u "$RUNNER_TEMP")/cbm-artifact"
           bash test-infrastructure/vm/vm-smoke.sh
@@ -279,6 +295,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # SMOKE_REQUIRE_WRAPPERS=1 needs a Go toolchain for the Go wrapper.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: pkg/go/go.mod
+          cache: false
+
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-linux-${{ matrix.arch }}-portable
@@ -301,6 +323,7 @@ jobs:
         env:
           CBM_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/cbm-artifact
           SMOKE_REQUIRE_UI: "1"
+          SMOKE_REQUIRE_WRAPPERS: "1"
 
       # The -portable binary is what all linux install/update paths now deliver;
       # it MUST start on old glibc (Debian 11 / RHEL 8 / Ubuntu 20.04). Runs it
 
@@ -25,7 +25,7 @@ on:
         type: string
         default: all
       test_selection:
-        description: 'PR test selection (smart CI): the artifact the select-tests job uploaded; the test-unix and test-windows legs run only its tests. Empty = every test (dry run, release, and any PR the selection does not narrow)'
+        description: 'PR test selection (smart CI): the artifact the select-tests job uploaded; the Linux x86_64 test-unix leg runs only its tests, the arm64, macOS and Windows legs run every test. Empty = every test (dry run, release, and any PR the selection does not narrow)'
         type: string
         default: ''
 
@@ -222,7 +222,11 @@ jobs:
             ccache-test-${{ matrix.os }}-${{ matrix.cc }}-
 
       - name: Fetch the test selection
-        if: ${{ inputs.test_selection != '' }}
+        # Only the Linux x86_64 leg narrows (user decision 2026-10-16): the
+        # coverage that justifies an omission comes from the Linux x86_64
+        # producer, so arm64, macOS and Windows code under #ifdef has static
+        # evidence only and those legs run every test.
+        if: ${{ inputs.test_selection != '' && runner.os == 'Linux' && runner.arch == 'X64' }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ inputs.test_selection }}
@@ -234,7 +238,7 @@ jobs:
           CBM_TEST_SHARD: ${{ matrix.shard }}
           CBM_TEST_LEG: ${{ matrix.os }}-${{ matrix.cc }}
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
-          CBM_TEST_SELECTION_DIR: ${{ inputs.test_selection != '' && format('{0}/test-selection', runner.temp) || '' }}
+          CBM_TEST_SELECTION_DIR: ${{ inputs.test_selection != '' && runner.os == 'Linux' && runner.arch == 'X64' && format('{0}/test-selection', runner.temp) || '' }}
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1500M
 
@@ -256,6 +260,23 @@ jobs:
           # shard-completeness job still gates the cross-shard union.
           if-no-files-found: warn
 
+      # The job log carries a red suite's SUMMARY; these are the complete logs
+      # behind it, so a failure can be read instead of re-run. The harness
+      # copies the log of every suite that did not end green, plus results.txt,
+      # into test-logs/failed/ (scripts/suite-failure-report.sh) — typically a
+      # few kilobytes for a red suite, not the ~25 MB of a whole run's logs.
+      # Runs only on a failed job. warn, not error: a job that failed OUTSIDE
+      # the suite wave (contract step, build, prod-binary guards) has no such
+      # directory, and a second error would only bury the first.
+      - name: Failing suite logs
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: suite-logs-${{ matrix.os }}-${{ matrix.cc }}-${{ strategy.job-index }}
+          path: build/c/test-logs/failed/
+          retention-days: 7
+          if-no-files-found: warn
+
       - name: Compiler cache (save)
         if: always() && (matrix.shard == null || startsWith(matrix.shard, '1/'))
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -301,6 +322,28 @@ jobs:
         shell: bash
         run: scripts/ci/test-package-wrappers.sh
 
+  # CodeAtlasWeb (graph-ui) leg: the frontend's own vitest suite (2000+
+  # tests; the render tests run under jsdom), its hardcoded-string and
+  # promise scans, its portable frozen acceptance checks, and a production
+  # build with the same npm ci the product build runs. One canonical script
+  # (scripts/ci/test-ui.sh) is the whole leg, here and locally. No browser
+  # is downloaded: the browser proofs (graph-ui/tools/smoke-*.mjs) need a
+  # running server and Playwright browsers, and they stay a local, manually
+  # dispatched venue documented in graph-ui/README.md rather than a hosted
+  # gate.
+  test-ui:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+
+      - name: CodeAtlasWeb leg (install, unit, style, promises, acceptance, build)
+        run: scripts/ci/test-ui.sh
+
   # ThreadSanitizer data-race gate. The threaded production surfaces (watcher,
   # subprocess, httpd, pipeline, mcp, worker pool, diagnostics, the runnable
   # daemon-coordination paths) plus allocator concurrency all run under TSan
@@ -353,6 +396,17 @@ jobs:
           scripts/test.sh CC=clang-21 CXX=clang++-21 \
             SANITIZE="-fsanitize=address,undefined -fno-omit-frame-pointer -fno-optimize-sibling-calls"
 
+      # Same step as in test-unix: the complete logs of the suites that did
+      # not end green, only when the job failed.
+      - name: Failing suite logs
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: suite-logs-diag
+          path: build/c/test-logs/failed/
+          retention-days: 7
+          if-no-files-found: warn
+
       - name: Compiler cache (save)
         if: always()
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -370,16 +424,19 @@ jobs:
   # artifact — the local ladder cannot answer that, having no faithful x86-64
   # emulation. It has now answered it, and the answer SPLIT the list:
   #
-  #   - the five deep-recursion suites overflow their thread stacks on x86-64
-  #     too, so that limit is NOT architectural;
+  #   - five suites aborted with "stack-overflow ... nested bug" on both
+  #     architectures. That was not deep recursion: it was MSan crashing while
+  #     it reported real uninitialized reads (reporting with the slow unwinder
+  #     exhausted the main thread's stack). scripts/msan.sh now unwinds with
+  #     frame pointers, the
+  #     reports print, the reads are fixed, and the five suites run again;
   #   - `cli` does not overflow here at all — it fails in the install path for
   #     an unrelated, still-undiagnosed reason;
   #   - `incremental` was a shadow-memory RSS artifact, now fixed in the test
   #     itself rather than skipped, so it stays in the lane.
   #
   # Per-cause detail lives in scripts/msan.sh, which is the single authoritative
-  # list both venues now share. Zero use-of-uninitialized-value findings were
-  # reported across the lane on either architecture.
+  # list both venues now share.
   test-msan:
     if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'msan') }}
     runs-on: ubuntu-latest
@@ -437,6 +494,17 @@ jobs:
           LLVM_PREFIX="$(brew --prefix llvm@22)"
           scripts/test.sh CC="$LLVM_PREFIX/bin/clang" CXX="$LLVM_PREFIX/bin/clang++"
 
+      # Same step as in test-unix: the complete logs of the suites that did
+      # not end green, only when the job failed.
+      - name: Failing suite logs
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: suite-logs-lsan-macos
+          path: build/c/test-logs/failed/
+          retention-days: 7
+          if-no-files-found: warn
+
       - name: Compiler cache (save)
         if: always()
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -553,13 +621,6 @@ jobs:
             ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-${{ github.ref }}-
             ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-
 
-      - name: Fetch the test selection
-        if: ${{ inputs.test_selection != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ inputs.test_selection }}
-          path: ${{ runner.temp }}/test-selection
-
       - name: Test
         shell: msys2 {0}
         # AddressSanitizer is unavailable on native ARM64 Windows (LLVM ships no
@@ -587,7 +648,8 @@ jobs:
           CBM_TEST_SHARD: ${{ matrix.shard }}
           CBM_TEST_LEG: ${{ matrix.os }}-${{ matrix.msystem }}
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
-          CBM_TEST_SELECTION_DIR: ${{ inputs.test_selection != '' && format('{0}/test-selection', runner.temp) || '' }}
+          # Windows legs run every test: see the Linux x86_64-only fetch in test-unix.
+          CBM_TEST_SELECTION_DIR: ''
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1500M
 
@@ -611,6 +673,17 @@ jobs:
           # shard-completeness job still gates the cross-shard union.
           if-no-files-found: warn
 
+      # Same step as in test-unix: the complete logs of the suites that did
+      # not end green, only when the job failed.
+      - name: Failing suite logs
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: suite-logs-${{ matrix.os }}-${{ matrix.msystem }}-${{ strategy.job-index }}
+          path: build/c/test-logs/failed/
+          retention-days: 7
+          if-no-files-found: warn
+
       # Shard 1 (or the unsharded job) saves the compiler cache; every shard
       # builds the identical runner, so one cache carries the full object set.
       - name: Compiler cache (save)