@@ -2550,10 +2550,20 @@ jobs:
       # @objectstack/core). Guards against a duplicate resolver copy drifting on a
       # security path (the REST-vs-dispatcher sys_user_role drift) and against an
       # entry point silently dropping the delegation.
+      #
+      # The second command is the same kind of guard on the write-time reference
+      # check: the code that may set the vouched-reference mark (a service verb
+      # vouching, on its own write, for the one record it proved) is pinned to an
+      # allowlist, so a new caller is a reviewed edit and never a quiet one. Its
+      # alias runs the census's `--self-test` first, which is what
+      # `check:self-test-wired` requires. Folded into this step rather than a step
+      # of its own: no new check context and no new required-status entry.
       - name: Single authz resolver guard
         id: single-authz-resolver-guard
         continue-on-error: true
-        run: pnpm check:authz-resolver
+        run: |
+          pnpm check:authz-resolver
+          pnpm check:vouch-for-reference-callers
 
       # #11352. Product code may not read a test-RUNNER variable (`TEST`,
       # `VITEST*`, `JEST_WORKER_ID`). Runner variables are INHERITED by every
 
@@ -206,6 +206,7 @@
     "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
     "check:swallow-census-controls": "node scripts/measure-durability-swallow-family.mjs --self-test=gated",
     "check:system-context-census": "node scripts/check-system-context-census.mjs --self-test && node scripts/check-system-context-census.mjs",
+    "check:vouch-for-reference-callers": "node scripts/check-vouch-for-reference-callers.mjs --self-test && node scripts/check-vouch-for-reference-callers.mjs",
     "gen:platform-object-tenancy-census": "node scripts/platform-object-tenancy-census.mjs --write",
     "check:platform-object-tenancy-census": "node scripts/check-platform-object-tenancy-census.mjs --self-test && node scripts/check-platform-object-tenancy-census.mjs"
   },
 
@@ -0,0 +1,46 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The call-site census of the vouched-reference mark (`vouchForReference`,
+ * `./vouched-reference.ts`), run where `Test Core` runs it: the gate's own
+ * self-test (its red and green cases, with the battery floor and the verdict
+ * handshake), then the scan of this tree, which must be green — every
+ * production file that sets the mark is in the gate's `ALLOWED_CALLERS` with
+ * its exact call-site count. The gate's header is the authority on the rule.
+ *
+ * The scan here is `--ts-only`: the files this pin judges are the files whose
+ * edits re-run it, the `packages/` glob ending in `.ts` of this package's
+ * entry in scripts/cross-package-test-inputs.mjs. `examples/`, `apps/` and the
+ * other source extensions are judged by the bare run in the lint step, on
+ * every PR; the gate's header, "Two surfaces", says why the pin does not
+ * judge them.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { spawnSync } from 'node:child_process';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(HERE, '../../../..');
+const GATE = resolve(HERE, '../../../../scripts/check-vouch-for-reference-callers.mjs');
+
+const run = (...args: string[]) =>
+  spawnSync(process.execPath, [GATE, ...args], { cwd: REPO_ROOT, encoding: 'utf8' });
+
+describe('check:vouch-for-reference-callers', () => {
+  it('its self-test reaches its verdict: every red and green case holds, and no battery fell below its floor', () => {
+    const out = run('--self-test');
+    expect(out.stderr).toBe('');
+    expect(out.status).toBe(0);
+    expect(out.stdout).toMatch(/self-test: \d+ cases pass/);
+  });
+
+  it('this tree is green on the .ts surface: the only production caller is the file-attachments writer, at its pinned count', () => {
+    const out = run('--ts-only');
+    expect(out.stderr).toBe('');
+    expect(out.status).toBe(0);
+    expect(out.stdout).toContain('(the .ts surface)');
+    expect(out.stdout).toContain('packages/services/service-storage/src/file-attachment-service.ts (2)');
+  });
+});
@@ -4,5 +4,6 @@
   "src/security/operation-private-keys.pin.test.ts",
   "src/security/row-serving-door-exposure.pin.test.ts",
   "src/security/second-object-read-exposure.pin.test.ts",
+  "src/security/vouched-reference-callers.pin.test.ts",
   "src/utils/import-runner-sandbox-fault-row.test.ts"
 ]
Original file line number	Diff line number	Diff line change
`@@ -4,5 +4,6 @@`
`4`	`4`	`"src/security/operation-private-keys.pin.test.ts",`
`5`	`5`	`"src/security/row-serving-door-exposure.pin.test.ts",`
`6`	`6`	`"src/security/second-object-read-exposure.pin.test.ts",`
	`7`	`+ "src/security/vouched-reference-callers.pin.test.ts",`
`7`	`8`	`"src/utils/import-runner-sandbox-fault-row.test.ts"`
`8`	`9`	`]`