@@ -25,6 +25,18 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '../../../..');
 const GATE = resolve(HERE, '../../../../scripts/check-vouch-for-reference-callers.mjs');
 
+/**
+ * The budget of each test, which spawns the census once. The `--ts-only` scan
+ * reads every `.ts` file under `packages/`, about a second on an idle machine;
+ * a runner building the monorepo alongside the suite can push that past
+ * vitest's default 5 s test timeout, and a timed-out test fails before any
+ * assertion runs, so it says nothing about the mark it guards and reds every
+ * batch it shares a shard with. The self-test is given the same budget because
+ * it pays the same process start on the same runner. 60 s is the budget of the
+ * sibling scan pin, `./operation-private-keys.pin.test.ts`.
+ */
+const SCAN_TIMEOUT_MS = 60_000;
+
 const run = (...args: string[]) =>
   spawnSync(process.execPath, [GATE, ...args], { cwd: REPO_ROOT, encoding: 'utf8' });
 
@@ -34,13 +46,13 @@ describe('check:vouch-for-reference-callers', () => {
     expect(out.stderr).toBe('');
     expect(out.status).toBe(0);
     expect(out.stdout).toMatch(/self-test: \d+ cases pass/);
-  });
+  }, SCAN_TIMEOUT_MS);
 
   it('this tree is green on the .ts surface: the only production caller is the file-attachments writer, at its pinned count', () => {
     const out = run('--ts-only');
     expect(out.stderr).toBe('');
     expect(out.status).toBe(0);
     expect(out.stdout).toContain('(the .ts surface)');
     expect(out.stdout).toContain('packages/services/service-storage/src/file-attachment-service.ts (2)');
-  });
+  }, SCAN_TIMEOUT_MS);
 });
@@ -360,8 +360,22 @@ export const CROSS_PACKAGE_TEST_INPUTS = {
     // of the vouched-reference mark, a root script, with `--ts-only`: the same
     // `packages/` `.ts` surface as this glob. The census's other extensions,
     // and its `examples/` and `apps/` roots, are judged by its bare run in the
-    // lint step, never by this pin.
-    globs: ['packages/**/*.ts', 'scripts/check-vouch-for-reference-callers.mjs'],
+    // lint step, never by this pin. The census imports `js-comment-mask.mjs`
+    // (which code is prose) and `invoked-as.mjs` (whether its dispatch runs),
+    // so an edit to either moves the pin's verdict and re-runs it.
+    globs: [
+      'packages/**/*.ts',
+      'scripts/check-vouch-for-reference-callers.mjs',
+      'scripts/js-comment-mask.mjs',
+      'scripts/invoked-as.mjs',
+    ],
+    heldBy: {
+      // The pin names only the census; these two are the census's own relative
+      // imports, loaded by the spawned child, so no path the pin quotes lands
+      // in them and the pin itself is what holds them.
+      'scripts/js-comment-mask.mjs': ['packages/core/src/security/vouched-reference-callers.pin.test.ts'],
+      'scripts/invoked-as.mjs': ['packages/core/src/security/vouched-reference-callers.pin.test.ts'],
+    },
   },
   '@objectstack/types': {
     // src/driver-error-classification.callers.test.ts is the #13440 gate: it
 
@@ -807,7 +807,9 @@
         "!.turbo/**",
         "!**/node_modules/**",
         "$TURBO_ROOT$/packages/**/*.ts",
-        "$TURBO_ROOT$/scripts/check-vouch-for-reference-callers.mjs"
+        "$TURBO_ROOT$/scripts/check-vouch-for-reference-callers.mjs",
+        "$TURBO_ROOT$/scripts/js-comment-mask.mjs",
+        "$TURBO_ROOT$/scripts/invoked-as.mjs"
       ]
     },
     "@objectstack/types#test:repo": {