@@ -3,8 +3,8 @@
 # or "local:<in-repo path>" (a fixture copied into the oracle's target/).
 # Optional lines: ref=, paths=, build=, include_tests=. Dev-branch only.
 #
-# Blind cross-tool run on an HTTP client lib — HttpClient/HttpRequestMessage
-# ownership-transfer patterns (the Polly Bulkhead shape that exercised our
-# escape analysis). Triage oracle-only into field-notes per the oracle.md
-# maintenance requirement.
-RestSharp/RestSharp
+# Clean re-run after fixing _is_test_path to drop dotted .NET test dirs
+# (Newtonsoft.Json.Tests). The first run leaked ~485 test findings into the diff
+# (own-only 489); with the fix the product picture is own-only 4. This confirms it
+# on fresh cross-tool output, not just the local replay.
+JamesNK/Newtonsoft.Json
@@ -379,13 +379,18 @@ def _is_test_path(path: str) -> bool:
     examples are never disposed by design) — counting them as product leaks inflates
     the oracle-only recall gap with example code that was never meant to dispose."""
     for seg in path.lower().split("/"):
-        # Exact match for short, collision-prone names — a `snippet` *prefix* would
-        # wrongly drop product dirs like `SnippetEngine`/`SnippetService` (Polly's
-        # `src/Snippets/Docs/*` is caught by the exact `snippets`/`docs` segments
-        # anyway). Prefix match only for the long, unambiguous plural-able ones.
-        if (seg in ("test", "tests", "doc", "docs", "snippet", "snippets")
-                or seg.startswith(("benchmark", "sample", "example"))):
-            return True
+        # Split each segment on '.' before matching, for the ubiquitous .NET
+        # `<Project>.Tests` / `Foo.Benchmarks` directory convention: the dir
+        # `Newtonsoft.Json.Tests` is ONE path segment, so a bare-segment check
+        # misses it (and silently drags ~485 test findings into the diff). Matching
+        # each dot-component catches the `tests` tail while keeping the original
+        # guards intact — exact match for short, collision-prone names (so a single
+        # component `SnippetEngine`/`Documentation` is NOT dropped, only an exact
+        # `snippet`/`doc`), prefix only for the long, unambiguous plural-able ones.
+        for part in seg.split("."):
+            if (part in ("test", "tests", "doc", "docs", "snippet", "snippets")
+                    or part.startswith(("benchmark", "sample", "example"))):
+                return True
     return False
 
 
@@ -560,10 +565,21 @@ def _selftest() -> int:
                ("tests/Foo/Bar.cs", "benchmarks/X/Y.cs", "src/Test/Z.cs",
                 "src/Snippets/Docs/Fallback.cs", "src/MyLib/docs/Example.cs")):
         fails.append("_is_test_path should match test/benchmark/doc/snippet trees")
+    # The .NET `<Project>.Tests` / `Foo.Benchmarks` convention: the dotted dir is a
+    # single path segment, so it must be matched on its dot-components — else a repo
+    # like Newtonsoft.Json (test tree `Newtonsoft.Json.Tests`) leaks ~485 test
+    # findings into the product diff (own-only 489 vs the true 4). The sibling
+    # product dir `Newtonsoft.Json` must stay IN scope.
+    if not all(_is_test_path(p) for p in
+               ("Src/Newtonsoft.Json.Tests/Bson/BsonReaderTests.cs",
+                "src/Foo.Benchmarks/Bench.cs")):
+        fails.append("_is_test_path should match dotted .NET test/benchmark project dirs")
     # ...but a product dir whose name merely *starts with* a marker word is NOT
-    # excluded — exact match for snippet/doc guards against dropping real code.
+    # excluded — exact match for snippet/doc guards against dropping real code, and
+    # the dot-split must leave a non-test dotted product namespace untouched.
     if any(_is_test_path(p) for p in ("Dapper/SqlMapper.cs", "src/Lib/A.cs",
-                                      "src/SnippetEngine/Foo.cs", "src/Documentation/Api.cs")):
+                                      "src/SnippetEngine/Foo.cs", "src/Documentation/Api.cs",
+                                      "Src/Newtonsoft.Json/JsonSerializer.cs")):
         fails.append("_is_test_path should not match product paths")
     # the scope note is gated on mode, not count: a product-only run that excluded
     # nothing must still say so (else it reads like a full-scope run).
@@ -607,7 +623,7 @@ def _selftest() -> int:
         fails.append(f"non-SARIF JSON masked as clean: {len(not_sarif)} findings, "
                      f"{ns_drift} unparsed")
 
-    total = 24
+    total = 25
     for f in fails:
         print(f"ORACLE SELFTEST FAIL: {f}")
     print(f"oracle_compare selftest: {total - len(fails)}/{total} checks passed")