@@ -564,8 +564,21 @@ const NOTICE_PROSE = 'converted at load; conversion';
  * Neither command contains a regex literal today, and the failure direction is
  * loud rather than silent — a derailed scan blanks call sites, which strands
  * ledger entries and reds `no ledger entry is stale` below.
+ *
+ * Memoized by source text, so each command is masked once per run however many
+ * cases read it. The scan is pure, so a source that changed is a new key.
  */
+const MASKED = new Map<string, string>();
+
 function codeOnly(src: string): string {
+  const hit = MASKED.get(src);
+  if (hit !== undefined) return hit;
+  const masked = maskSource(src);
+  MASKED.set(src, masked);
+  return masked;
+}
+
+function maskSource(src: string): string {
   const out = src.split('');
   const N = src.length;
   const blank = (from: number, to: number): void => {
@@ -637,14 +650,33 @@ const NOT_CALLABLE: ReadonlySet<string> = new Set([
  *   - a gate never CALLED here but handed on as a value (`list.map(gate)`).
  *     Asserted absent by requiring every value import to be either called or
  *     declared in a ledger.
+ *
+ * ⚠️ Cost, which is linear and must stay so. The three tests below read only
+ * the text just before a match: the whitespace run in front of it, plus at
+ * most nine characters before that run (the `\b` before `function`, or the
+ * `..` before a `.`). `before` is therefore cut there rather than at the start
+ * of the file, so each match reads a few characters, not the whole file up to
+ * it, and the answer is the same. Slicing from 0 made one scan of `compile.ts`
+ * cost about 20 ms (549 matches each re-reading up to 88 KB), while the masker
+ * costs about 3 ms. The "no call shape" case scanned once per value import, so
+ * it timed out at vitest's 5 s default on a loaded Test Core runner. Results
+ * are memoized by source text for the same reason as {@link codeOnly}.
  */
-function callSitesOf(src: string): Set<string> {
+const CALL_SITES = new Map<string, ReadonlySet<string>>();
+
+function callSitesOf(src: string): ReadonlySet<string> {
+  const hit = CALL_SITES.get(src);
+  if (hit !== undefined) return hit;
   const code = codeOnly(src);
   const found = new Set<string>();
   const re = /([A-Za-z_$][\w$]*)\s*\(/g;
   let m: RegExpExecArray | null;
   while ((m = re.exec(code)) !== null) {
-    const before = code.slice(0, m.index);
+    // Start of the whitespace run in front of the match. A blanked comment or
+    // string is part of that run, so it can be long: walk it, never assume it.
+    let ws = m.index;
+    while (ws > 0 && /\s/.test(code[ws - 1])) ws--;
+    const before = code.slice(Math.max(0, ws - 9), m.index);
     // Tail of a longer identifier, or a property access. `...spread(` is a
     // call of `spread`, so the dot test must not fire on the third dot.
     if (/[\w$]$/.test(before)) continue;
@@ -654,10 +686,11 @@ function callSitesOf(src: string): Set<string> {
     if (NOT_CALLABLE.has(m[1])) continue;
     found.add(m[1]);
   }
+  CALL_SITES.set(src, found);
   return found;
 }
 
-const callSitesIn = (file: string): Set<string> => callSitesOf(sourceOf(file));
+const callSitesIn = (file: string): ReadonlySet<string> => callSitesOf(sourceOf(file));
 
 /** Is `name` invoked anywhere in this command's source? */
 const calls = (file: string, name: string) => callSitesIn(file).has(name);
@@ -1107,6 +1140,15 @@ describe('os validate is the read-only superset of os build (#3782, #4409)', ()
     // under-reports: a spread-applied call is a call, a property access is not.
     expect(callSitesOf('const a = [...lintUnknownStackKeys(s)];\n').has('lintUnknownStackKeys')).toBe(true);
     expect(callSitesOf('const a = registry.findFoo(s);\n').has('findFoo')).toBe(false);
+
+    // The look-behind is cut at the whitespace run before a match, and a
+    // blanked comment is part of that run. A comment longer than any fixed
+    // window between the dot (or the keyword) and the name must not turn a
+    // property access or a declaration into a call.
+    const longComment = `/* ${'x'.repeat(200)} */`;
+    expect(callSitesOf(`const a = registry.\n  ${longComment}\n  findFoo(s);\n`).has('findFoo')).toBe(false);
+    expect(callSitesOf(`async function\n  ${longComment}\n  declared(s) {}\n`).has('declared')).toBe(false);
+    expect(callSitesOf(`const a = [...\n  ${longComment}\n  lintUnknownStackKeys(s)];\n`).has('lintUnknownStackKeys')).toBe(true);
   });
 
   it('no ledger entry is stale', () => {
@@ -1170,6 +1212,7 @@ describe('os validate is the read-only superset of os build (#3782, #4409)', ()
       // statement it skipped drops names from the classification demand, which
       // is silent in the wrong direction.
       const values = valueImportsOf(src);
+      const called = callSitesOf(src);
       expect(
         importsConsumed.get(src),
         `${file}: the import parse consumed ${importsConsumed.get(src)} of ${importStatementCount(src)} ` +
@@ -1181,7 +1224,7 @@ describe('os validate is the read-only superset of os build (#3782, #4409)', ()
       // (`list.map(gate)`) rather than called, which has no `gate(` call site
       // at all. `formatUnknownAuthoringKey` is exactly that shape today.
       const unaccounted = [...values]
-        .filter((name) => !callSitesIn(file).has(name) && !CLASSIFIED.has(name))
+        .filter((name) => !called.has(name) && !CLASSIFIED.has(name))
         .sort();
       expect(
         unaccounted,