@@ -10,22 +10,34 @@
 //      left by a developer's earlier run on a tree without this isolation, or by
 //      a crashed run. The guard judges only what THIS run leaves, so an old
 //      leftover never reds a run that wrote nothing.
-//   2. It creates ONE temporary root for the run and hands it to every worker
-//      through `provide` / `inject`. Each test file makes its own working
-//      directory under that root.
+//   2. It reserves a TAG for the run, `os-dogfood-run-XXXXXX`, as a directory
+//      `mkdtempSync` creates under the system temp directory, and hands the tag
+//      (a name, never a path) to every worker through `provide` / `inject`.
+//      Each test file makes its own working directory directly under the system
+//      temp directory, named `<tag>-file-XXXXXX`.
 //
-// At the END of the run it removes that root, and with it every per-file
-// directory. The removal is run-level, not per-file: on the `shared-showcase`
-// project (`isolate: false`) one memoized boot serves every file on a worker,
-// and its SQLite handles stay open in the directory of the file that booted it.
+// At the END of the run it removes every directory whose name starts with this
+// run's `<tag>-file-`, then the reservation itself. Another run's directories
+// carry another tag, so a concurrent run on the same machine is never touched.
+// The removal is run-level, not per-file: on the `shared-showcase` project
+// (`isolate: false`) one memoized boot serves every file on a worker, and its
+// SQLite handles stay open in the directory of the file that booted it.
+//
+// Why a tag and not a shared parent path (#21924): every `mkdtempSync` base in
+// this tree must be one the tree's scratch-directory scan can read, so that an
+// in-tree fixture root can never hide behind an expression
+// (`scripts/pm/dispatch-gates.mjs`, "no mkdtempSync site in this tree takes a
+// base the scan cannot read"). A path handed over through `inject()` is such an
+// expression. `join(tmpdir(), ...)` is not: it is outside the tree by
+// construction, whatever name follows it.
 //
 // ⛔ This teardown never JUDGES anything. On vitest 4.1.11 an error thrown from
 // a globalSetup teardown is printed as `error during close` and the run still
 // exits 0 (measured), so a guard placed here would be a false green. The guard
 // is a throwing `afterAll` in the per-file module, which fails a test file.
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import type { TestProject } from 'vitest/node';
 
@@ -34,19 +46,29 @@ const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 declare module 'vitest' {
   export interface ProvidedContext {
-    /** The run's temporary root; each test file makes its working directory under it. */
-    dogfoodCwdRoot: string;
+    /** The run's tag; each test file makes its working directory as `join(tmpdir(), '<tag>-file-')`. */
+    dogfoodRunTag: string;
   }
 }
 
-let runRoot: string | undefined;
+/** The prefix of every per-file directory a run tagged `tag` creates under the system temp directory. */
+export function perFileDirPrefix(tag: string): string {
+  return `${tag}-file-`;
+}
+
+let reservation: string | undefined;
 
 export function setup(project: TestProject): void {
   rmSync(join(PACKAGE_ROOT, '.objectstack'), { recursive: true, force: true });
-  runRoot = mkdtempSync(join(tmpdir(), 'os-dogfood-run-'));
-  project.provide('dogfoodCwdRoot', runRoot);
+  reservation = mkdtempSync(join(tmpdir(), 'os-dogfood-run-'));
+  project.provide('dogfoodRunTag', basename(reservation));
 }
 
 export function teardown(): void {
-  if (runRoot) rmSync(runRoot, { recursive: true, force: true });
+  if (!reservation) return;
+  const prefix = perFileDirPrefix(basename(reservation));
+  for (const name of readdirSync(tmpdir())) {
+    if (name.startsWith(prefix)) rmSync(join(tmpdir(), name), { recursive: true, force: true });
+  }
+  rmSync(reservation, { recursive: true, force: true });
 }
@@ -19,10 +19,18 @@
 // ## What it does
 //
 // At module top level, which runs before the test file's own imports, it makes
-// a directory under the run's temporary root and `chdir`s into it. `afterAll`
-// restores the previous working directory. The directories are removed at the
-// end of the run by the globalSetup, not here: the memoized `shared-showcase`
-// boot keeps its SQLite handles open in the first file's directory.
+// a directory directly under the system temp directory, named with the run's
+// tag (`<tag>-file-XXXXXX`), and `chdir`s into it. `afterAll` restores the
+// previous working directory. The directories are removed at the end of the
+// run by the globalSetup, which sweeps its own tag, not here: the memoized
+// `shared-showcase` boot keeps its SQLite handles open in the first file's
+// directory.
+//
+// The base is spelled `join(tmpdir(), ...)` on purpose (#21924): the tree's
+// scratch-directory scan must be able to read every `mkdtempSync` base, and a
+// path received through `inject()` is one it cannot read. Only the run's TAG
+// comes through `inject()`, as a name component, and it is refused below if
+// it could carry a separator.
 //
 // The invariant for every dogfood author: a file runs in its own temporary
 // cwd, so anything cwd-relative it writes is its own and disappears with the
@@ -38,26 +46,31 @@
 // what this run leaves.
 import { afterAll, inject } from 'vitest';
 import { existsSync, mkdtempSync, readdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { perFileDirPrefix } from './per-file-cwd.global-setup.js';
 
 /** `packages/qa/dogfood`, resolved from this module's own location. */
 const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url));
 /** What a file must never leave in the package directory. */
 const LEFTOVER = join(PACKAGE_ROOT, '.objectstack', 'data');
 
-const runRoot = inject('dogfoodCwdRoot');
-if (!runRoot) {
+const runTag = inject('dogfoodRunTag');
+if (!runTag) {
   throw new Error(
-    'per-file-cwd.setup.ts: no run root was provided. The globalSetup ' +
+    'per-file-cwd.setup.ts: no run tag was provided. The globalSetup ' +
       '`test/per-file-cwd.global-setup.ts` must be wired in packages/qa/dogfood/vitest.config.ts; ' +
       'without it this file would run in the package directory.',
   );
 }
+if (/[\\/]|\.\./.test(runTag)) {
+  throw new Error(`per-file-cwd.setup.ts: the run tag ${JSON.stringify(runTag)} is not a plain directory name.`);
+}
 
 const previousCwd = process.cwd();
 const presentAtStart = existsSync(LEFTOVER);
-process.chdir(mkdtempSync(join(runRoot, 'file-')));
+process.chdir(mkdtempSync(join(tmpdir(), perFileDirPrefix(runTag))));
 
 afterAll(() => {
   process.chdir(previousCwd);
 
@@ -143,7 +143,7 @@ runProjectCliOverridePreflight({
 //     `.objectstack/data` exists in the package directory: that throw is the guard.
 //   - The `globalSetup` below is ROOT-level: one run, one call, covering both
 //     projects and each `OS_TEST_SHARD` slice (measured). It clears a stale
-//     `.objectstack` at the start and removes the run's temporary root at the end.
+//     `.objectstack` at the start and removes the run's per-file directories at the end.
 //     Its teardown judges nothing, because a throw there exits 0 on vitest 4.1.11.
 // Both modules' headers carry the rest, including what a dogfood author owes.
 const PER_FILE_CWD = './test/per-file-cwd.setup.ts';
 
@@ -113,7 +113,7 @@ const REFUSED: ReadonlyArray<readonly [
 // §1 Both carriers refuse, at the list's own path
 // ---------------------------------------------------------------------------
 
-describe('#20080 §1 — both analytics carriers refuse a list inside a nested relation', () => {
+describe('§1 — both analytics carriers refuse a list inside a nested relation, at save', () => {
   it.each(REFUSED)('DatasetSchema.filter refuses %s', (_label, filter, issuePath) => {
     const issue = issueAt(DatasetSchema.safeParse(withScope(filter)), `filter.${issuePath}`);
     expect(issue.message).toMatch(/requires a single comparable value, but received an array/);
@@ -145,7 +145,7 @@ describe('#20080 §1 — both analytics carriers refuse a list inside a nested r
 // §2 The carrier prints the analytics door's sentence
 // ---------------------------------------------------------------------------
 
-describe('#20080 §2 — the carrier refusal is the analytics door\'s sentence', () => {
+describe('§2 — the carrier refusal is the analytics door\'s sentence', () => {
   it.each(REFUSED)('%s', (_label, filter, issuePath, field, list, eq, holder) => {
     const door = analyticsDoorRefusal(field, eq ? { $eq: list } : list, holder);
     // The door's refusal is the ADR-0112 class-1 envelope the face throws.
@@ -175,7 +175,7 @@ describe('#20080 §2 — the carrier refusal is the analytics door\'s sentence',
 // §3 A list the shared schema already refuses is refused once, not twice
 // ---------------------------------------------------------------------------
 
-describe('#20080 §3 — outside a nested relation the shared schema answers, once', () => {
+describe('§3 — outside a nested relation the shared schema answers, once', () => {
   it.each([
     ['top level, implicit', { region: ['a'] }, 'region', /^The implicit-equality comparand on field "region"/],
     ['top level, $eq', { region: { $eq: ['a'] } }, 'region.$eq', /^Operator "\$eq" on field "region"/],
@@ -192,7 +192,7 @@ describe('#20080 §3 — outside a nested relation the shared schema answers, on
 // §4 CONTROLS — accepted on both carriers, and kept
 // ---------------------------------------------------------------------------
 
-describe('#20080 §4 — what a nested relation may still carry', () => {
+describe('§4 — what a nested relation may still carry', () => {
   const day = new Date('2026-07-01T00:00:00.000Z');
   it.each([
     ['a scalar', { account: { region: 'a' } }],
@@ -217,7 +217,7 @@ describe('#20080 §4 — what a nested relation may still carry', () => {
     expect(measure.data!.filter).toEqual(filter);
   });
 
-  it('[#20116] $ne carrying a list inside a relation is refused on both carriers, in the door\'s $ne sentence', () => {
+  it('$ne carrying a list inside a relation is refused on both carriers, in the door\'s $ne sentence', () => {
     // This row sat in the table above as "not yet at this save door (#20116)".
     // #20116 routes every slot this walk reaches through the query faces'
     // verdict, so the shape the analytics door refuses on chart is refused here.
 
@@ -58,7 +58,7 @@ const defOf = (s: unknown): unknown => (s as { _zod?: { def?: unknown } })?._zod
 // derivation or a coincidence. A zod upgrade that changes `clone()` semantics
 // changes the bridge's meaning, and that must be LOUD rather than silent.
 // ============================================================================
-describe('#5056 premise — which zod builders share the `_zod.def` object', () => {
+describe('the derived-clone bridge premise — which zod builders share the `_zod.def` object', () => {
   it('`.describe()` shares the def of the instance it was called on', () => {
     // THE mechanism behind #5056. `clone(inst)` without an explicit def reuses
     // `inst._zod.def`, so a described clone is def-IDENTICAL to its receiver.
@@ -104,7 +104,7 @@ describe('#5056 premise — which zod builders share the `_zod.def` object', ()
 // ============================================================================
 // 2. The three controls, on the instrument itself.
 // ============================================================================
-describe('#5056 controls — the walker finds doors, and only real ones', () => {
+describe('controls — the walker finds doors, and only real ones', () => {
   it('positive: live authoring roots resolve, and the graph is really walked', () => {
     const { verdict, nodeCount, rootCount } = measureDoors();
     expect(rootCount, 'every metadata type plus ObjectStackSchema').toBeGreaterThan(20);
@@ -153,7 +153,7 @@ describe('#5056 controls — the walker finds doors, and only real ones', () =>
 // ============================================================================
 // 3. The #5056 regression boundary itself.
 // ============================================================================
-describe('#5056 regression — the any-one-shared-property bridge stays dead', () => {
+describe('regression — the any-one-shared-property bridge stays dead; a share of the shape decides', () => {
   it('a 2-of-19 shared-leaf shape shares leaves with the live graph but is NOT derived from it', () => {
     // The reverse verification, standing rather than one-shot.
     //
@@ -213,6 +213,6 @@ describe('#5056 regression — the any-one-shared-property bridge stays dead', (
       label: I18nLabelSchema.describe('Display label'),
     });
     expect(cloneOverlap(allSharedLeaves), '2 shared of 2 keys').toBe(1);
-    expect(verdict(allSharedLeaves), 'the residual false-reachable case — see #5828').toBe('derived-clone');
+    expect(verdict(allSharedLeaves), 'the residual false-reachable case — no threshold excludes it').toBe('derived-clone');
   });
 });
@@ -81,7 +81,7 @@ const sentenceContaining = (source: string, anchor: string): string => {
 /** Root tokens that are still true on these surfaces and must stay in place. */
 const SURVIVING_ROOTS = ['features', 'os.user'] as const;
 
-describe('#17203 — no UI prose face advertises `app` as an expression-scope root', () => {
+describe('no UI prose face advertises `app` as an expression-scope root — the renderer no longer mounts it', () => {
   describe('published faces (read by authoring tools and republished into the reference docs)', () => {
     it('`PageComponentSchema.visibleWhen`.describe() does not name `app` among the mounted roots', () => {
       // ⚠️ NOT `.shape` — ADR-0089 D3a made this schema a `.strict().transform(…)`
 
@@ -58,7 +58,7 @@ const DOORS: readonly Door[] = [
     layoutPath: ['layout'],
   },
   {
-    name: "ComponentPropsMap['object-form'] (the #5068 props gate's dispatch)",
+    name: "ComponentPropsMap['object-form'] (the props gate's dispatch)",
     parse: (layout) => ComponentPropsMap['object-form'].safeParse({ objectName: 'crm_lead', layout }),
     layoutPath: ['layout'],
   },
@@ -86,7 +86,7 @@ const DOORS: readonly Door[] = [
   },
 ];
 
-describe('form `layout` — the retired arms are refused with the prescription (#20221)', () => {
+describe('form `layout` — the retired arms are refused with the prescription', () => {
   for (const door of DOORS) {
     describe(door.name, () => {
       it("'grid' → refused, prescribing 'vertical' and naming `columns` for multi-column", () => {
@@ -138,7 +138,7 @@ describe('form `layout` — the retired arms are refused with the prescription (
   });
 });
 
-describe(`D2 conversion \`${CONVERSION_ID}\` (#20221)`, () => {
+describe(`D2 conversion \`${CONVERSION_ID}\``, () => {
   const conversion = CONVERSIONS_BY_MAJOR[18]!.find((c) => c.id === CONVERSION_ID);
 
   it('is registered under protocol 18 and retired from the load path', () => {
@@ -217,7 +217,7 @@ describe(`D2 conversion \`${CONVERSION_ID}\` (#20221)`, () => {
   });
 });
 
-describe('D3: the family entry and the chain step are registered (#20221)', () => {
+describe('D3: the family entry and the chain step are registered', () => {
   const step = MIGRATIONS_BY_MAJOR[18]!;
 
   it(`the protocol-18 step wires \`${CONVERSION_ID}\``, () => {
 
@@ -284,7 +284,7 @@ describe('ruling 乙 item 1, on real spec enums — each case with a firing and
     });
   });
 
-  describe('a spellable enum row with a labelled inline list (`object.sharingModel`, the #19331 shape)', () => {
+  describe('a spellable enum row with a labelled inline list (`object.sharingModel`, as its form row writes it)', () => {
     const members = servedEnum('object', 'sharingModel');
     const LABELS: Record<string, string> = {
       private: 'Private — owner only',
 
@@ -278,7 +278,7 @@ const PARITY_VECTORS: readonly ParityVector[] = [
   },
 ];
 
-describe('resolveI18nLabel — rule parity with objectui pickLocalized (#6765 / #6761 ruling B)', () => {
+describe('resolveI18nLabel — rule parity with objectui pickLocalized (ruled: one shared resolver, on the server)', () => {
   describe('the vector table really is the reference\'s behaviour', () => {
     it.each(PARITY_VECTORS)('$limb', ({ label, locale, pick }) => {
       // Asserted against the copied reference FIRST. If this row is wrong, the
@@ -326,7 +326,7 @@ describe('resolveI18nLabel — the producer-facing return shape', () => {
     expect(resolveI18nLabel({ en: '' }, 'en')).toBe('');
   });
 
-  it('composes with `??` into the producer call shape #6761 needs', () => {
+  it('composes with `??` into the producer call shape the dataset compiler needs', () => {
     // `dataset-compiler.ts:374/406` today: `typeof d.label === 'string' ? d.label : d.name`,
     // which publishes the MACHINE NAME as a display title for a map label.
     const dimension = { name: 'owner', label: { en: 'Owner', 'zh-CN': '负责人' } as I18nLabel };
@@ -337,7 +337,7 @@ describe('resolveI18nLabel — the producer-facing return shape', () => {
   });
 });
 
-describe('resolveI18nLabel — the rule departures converged with objectui#3907; one departure survives', () => {
+describe('resolveI18nLabel — the rule departures converged once objectui read only own, string-valued entries; one departure survives', () => {
   // Before objectui#3907 (landed as objectui PR #4359) this module's rule
   // documented two DELIBERATE narrowings of the reference. #4359 landed the
   // same two guards upstream, so the copied reference now answers identically
@@ -372,7 +372,7 @@ describe('resolveI18nLabel — the rule departures converged with objectui#3907;
     expect(resolveI18nLabel(offSpec, 'zh-CN')).toBe('Owner');
   });
 
-  it('refuses an off-contract scalar rather than stringifying it — the one departure objectui#3907 did NOT touch', () => {
+  it('refuses an off-contract scalar rather than stringifying it — the one departure the objectui map-limb fix did NOT touch', () => {
     // `pickLocalized` accepts `unknown` and stringifies numbers/booleans
     // (`pickLocalized(42, 'en')` is `'42'`). This resolver's parameter is the
     // declared `I18nLabel`, so the shapes below are type errors — the
@@ -388,7 +388,7 @@ describe('resolveI18nLabel — the rule departures converged with objectui#3907;
   });
 });
 
-describe('resolveI18nLabel — the type signature refuses the calls that caused #6761', () => {
+describe('resolveI18nLabel — the type signature refuses the calls behind the dropped dataset label', () => {
   // Reverse verification at the type level. `check:test-typecheck` compiles this
   // file (packages/spec/tsconfig.test.json), so each directive below is a REAL
   // check: delete the argument it guards and tsc goes red on the unused