From 460b5829244a6fe43e60371496ead97dd2d1a3a1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 30 Oct 2026 11:45:51 +0000
Subject: [PATCH 1/2] ci: schedule the ui jobs and Build Docs on a root
 package.json diff (#27717)

setup-pnpm reads the root manifest's `packageManager` field to pick the
pnpm it materialises, and every ui job and Build Docs run it. The `ui:` and
`docs:` filter lists carried no `package.json` row, so a diff confined to a
pnpm bump started none of them on the PR. Both lists gain the row; `core:`
already had it.

The parity gate's header named setup-pnpm as the one local composite
action its recognizer does not follow. Build Core uses setup-workspace,
which calls setup-pnpm in turn; the bound now says so.

Claude-Session: https://claude.ai/code/session_01L9qibxnVpxAbqTXMwJU6LM
Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.yml           | 10 ++++++++++
 scripts/check-ci-filter-parity.mjs |  6 ++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41c5a3755bc..1875ed6c463 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -280,6 +280,11 @@ jobs:
               - '.nvmrc'
               - '.github/actions/setup-workspace/**'
               - '.github/actions/setup-pnpm/**'
+              # setup-pnpm materialises the pnpm the root manifest's
+              # `packageManager` field pins (#27717), so a diff confined to
+              # that field changes the pnpm Build Docs installs with. `core:`
+              # already carries this row for its own jobs.
+              - 'package.json'
             core:
               - 'packages/**'
               - 'examples/**'
@@ -533,6 +538,11 @@ jobs:
               # PR, nor in the queue, where these outputs read the same diff.
               - '.nvmrc'
               - '.github/actions/setup-pnpm/**'
+              # The root manifest, because setup-pnpm reads its `packageManager`
+              # field to pick the pnpm every ui job runs (#27717). A diff
+              # confined to a pnpm bump matched no list here, so the ui jobs
+              # skipped on the PR and in the queue alike.
+              - 'package.json'
             # The seven packages objectui installs from this tree (the set its
             # `.objectstack-pin` used to pack). A change here compiles and builds
             # the Console in the same PR — the check the retired Spec Shape Gate
diff --git a/scripts/check-ci-filter-parity.mjs b/scripts/check-ci-filter-parity.mjs
index 44654807bc8..fd9dc2d3e39 100644
--- a/scripts/check-ci-filter-parity.mjs
+++ b/scripts/check-ci-filter-parity.mjs
@@ -190,8 +190,10 @@
  * script a PACKAGE's own manifest runs (`pnpm --filter <pkg> <script>`) is
  * not followed (today's one such step, the spec's `analyze`, runs a file
  * inside `packages/spec`, which `packages/**` covers); a local composite
- * action a step `uses:` is not followed (today's one, setup-pnpm, names no
- * repository script, and every job in every workflow runs it); `pnpm
+ * action a step `uses:` is not followed (today's one is setup-workspace: its
+ * own `run:` steps name no repository script, and neither do those of the
+ * setup-pnpm it calls in turn; its files and the `.nvmrc` and root
+ * `packageManager` it reads are `core:` rows of their own, #27673); `pnpm
  * install`'s lifecycle (`prepare` -> `scripts/setup-git-hooks.mjs`) is not a
  * guard (every job installs, the unfiltered lint.yml jobs included, so a
  * change to it already runs at PR time); a script spelled in an extension

From 115b9df6f23635d5826a6c40a28c353f4e9256af Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 30 Oct 2026 11:50:00 +0000
Subject: [PATCH 2/2] ci: schedule Test Core for the generic test task's ui
 inputs (#27961)

turbo.json's generic `test` task hashes five ui-tree inputs that no
`core:` row matched: ui/vitest.config.mts, ui/vitest.setup.*,
ui/scripts/test-shard-*, and the Console's vitest and vite configs. A
diff confined to one moved every package's test hash and started Test
Core first in the merge queue. They join `core:`, beside the six ui build
inputs, on the same reasoning.

check-ci-filter-parity gains a fourth subject that derives the root
inputs of `test` / `test:repo` from turbo.json and judges them against
the lists the `test` job's `if:` ORs. The subject is required, not only
a strengthening: the third subject's leftover rule read the new
`ui/vitest.config.mts` row as a leftover, because ui/ holds a literal
build input and no reason named the test input. Generic test inputs are
now reasons for that rule too. The self-test gains battery (11).

lint.yml's shared-module self-test step runs five self-tests since the
ui entry predicate joined it; its name, comment and last line no longer
pin a member count.

Claude-Session: https://claude.ai/code/session_01L9qibxnVpxAbqTXMwJU6LM
Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.yml           |  13 ++
 .github/workflows/lint.yml         |  25 +--
 scripts/check-ci-filter-parity.mjs | 248 +++++++++++++++++++++++++++--
 3 files changed, 266 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1875ed6c463..522e171e501 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -366,6 +366,19 @@ jobs:
               - 'ui/scripts/check-dist-completeness.mjs'
               - 'ui/scripts/invoked-as.mjs'
               - 'ui/scripts/vitest-invocation-guard.mjs'
+              # TEST INPUTS outside every package (#27961): each `$TURBO_ROOT$/…`
+              # input of turbo.json's generic `test` task. That task runs for
+              # every package Test Core tests, so a diff confined to one moves
+              # every `#test` hash, and before these rows Test Core first ran on
+              # it in the merge queue. `vitest.preset.mts` above and the
+              # `vite-*.ts` / `vitest-invocation-guard.mjs` build rows cover the
+              # other three; check-ci-filter-parity derives the set from
+              # turbo.json and reds while one is uncovered here.
+              - 'ui/vitest.config.mts'
+              - 'ui/vitest.setup.*'
+              - 'ui/scripts/test-shard-*'
+              - 'ui/apps/console/vitest.config.ts'
+              - 'ui/apps/console/vite.config.ts'
               # BUILD CORE'S GUARDS (#21341): every repository script the
               # build-core job's own steps run (named by a `run:` step or
               # reached through its `pnpm check:*` alias) and each one's
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 996f62765f6..9afd03982ee 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -790,8 +790,13 @@ jobs:
       # explicitly does not ask for. ⛔ It is also not a licence to sweep the
       # rest of that remainder from here; that is a separate card.
       #
-      # What runs here is the self-tests, not the modules' callers: for the first
-      # three the callers are the two routing gates named above, which already run on
+      # `ui/scripts/invoked-as.mjs`, the ui tree's twin of the entry predicate,
+      # joined beside it (#27283): `ci.yml`'s `core:` filter names it as a build
+      # input, so `check:self-test-wired` counts it as a script CI runs, and its
+      # `--self-test` ran nowhere else.
+      #
+      # What runs here is the self-tests, not the modules' callers: for the three
+      # #10608 modules the callers are the two routing gates named above, which already run on
       # every PR; for `import-prerequisite` the callers are the 45 importing
       # gates, whose ordinary runs take the branch where the dependency IS
       # present and therefore observe none of what the self-test pins.
@@ -799,25 +804,27 @@ jobs:
       # INVOCATION IDIOM note at the top of this file.
       # `ts-parse` spawns ~20 real node children (~10 s measured, and the spawns
       # are the point — they pin that a caller's try/catch cannot swallow the
-      # refusal); the other three are in-process fixtures, ~0.6 s combined.
+      # refusal); the others are in-process fixtures, ~0.9 s combined.
       #
       # ⭐ Collected rather than sequenced, for the reason spelled out at the
       # `Shallow-history guard self-tests` step below (#10814): under `bash -e` a
       # bare sequence stops at the first failure, so a red `ts-parse` would leave
       # the entry-predicate, comment-mask and prerequisite-frame self-tests UNRUN
       # while the log shows only the one failure. `ts-parse` is both the slowest
-      # of the four and the one that spawns real children, so it is the likeliest
-      # to be red — precisely the masking direction. The four modules are
-      # independent of one another, so collecting loses nothing.
+      # of them and the one that spawns real children, so it is the likeliest
+      # to be red — precisely the masking direction. The modules are
+      # independent of one another, so collecting loses nothing. This note, the
+      # step name and its last line name no member count: the list below is the
+      # one place that says how many run.
       #
       # ⭐ Collected is also why the fourth leg is HERE rather than in a step of
       # its own: Actions skips a job's remaining steps once a step fails, so a
       # standalone step further down this job would be masked by every gate above
       # it — the same defect one level up, and the split `check-step-collectors`
       # explicitly refuses as a remedy. Inside this block the frame's self-test
-      # prints its own verdict whatever the other three do, and it does so early
+      # prints its own verdict whatever the others do, and it does so early
       # in the job.
-      - name: scripts/ shared-module self-tests (parse · entry predicate · comment mask · prerequisite frame)
+      - name: scripts/ shared-module self-tests (parse · entry predicate, root and ui · comment mask · prerequisite frame)
         id: scripts-shared-module-self-tests-parse-entry
         continue-on-error: true
         run: |
@@ -850,7 +857,7 @@ jobs:
             printf "%s" "$failed"
             exit 1
           fi
-          echo "scripts/ shared-module self-tests — all four ran and passed"
+          echo "scripts/ shared-module self-tests — every one ran and passed"
 
       # Every `scripts/**` TypeScript parse goes through ONE module (#10133 /
       # #10573), and this is the half that keeps it that way (#10574).
diff --git a/scripts/check-ci-filter-parity.mjs b/scripts/check-ci-filter-parity.mjs
index fd9dc2d3e39..72cb93a1a85 100644
--- a/scripts/check-ci-filter-parity.mjs
+++ b/scripts/check-ci-filter-parity.mjs
@@ -202,6 +202,36 @@
  * baseline) is not a script and is not derived. The self-test pins the first
  * two against the real tree.
  *
+ * ## The fourth subject: Test Core and the generic test tasks' root inputs (#27961)
+ *
+ * turbo.json's generic `test` and `test:repo` tasks -- the two Test Core's
+ * `turbo run test test:repo` names -- run for every package Test Core tests,
+ * so each `$TURBO_ROOT$/...` input of theirs moves every package's test hash.
+ * Before this subject nothing held them to the scheduler: `vitest.preset.mts`
+ * sat in `core:` by hand, and five ui-tree inputs (`ui/vitest.config.mts`,
+ * `ui/vitest.setup.*`, `ui/scripts/test-shard-*` and the Console's two Vite
+ * configs) matched no list the `test` job's `if:` reads, so a diff confined to
+ * one started Test Core first in the merge queue.
+ *
+ * `judgeTestInputs` derives the population from turbo.json and judges it with
+ * the same pure-string rule against the lists the `test` job ORs, read back
+ * out of its `if:` exactly as the first subject reads them. The remedy is a
+ * `core:` row, never `crosspkg:`: the first subject holds `crosspkg` to the
+ * declarations, and a generic test input is no package's declaration.
+ *
+ * The population is also a REASON for the third subject's leftover rule. A
+ * literal `core:` row in a directory holding a build input is there for a test
+ * input just as legitimately: without it, `ui/vitest.config.mts` (beside the
+ * build input `ui/tsconfig.json`) read as a leftover the moment it was added.
+ *
+ * Known bounds: a `<package>#test` task's root inputs are the first subject's
+ * population (the declarations `--verify` mirrors into turbo.json) and are not
+ * judged a second time here; `globalDependencies` are the third subject's, and
+ * `core` covering them starts Test Core too. Refusals: the first subject's
+ * reads of ci.yml and the `test` job's `if:`, turbo.json unreadable or not
+ * JSON, no `tasks` map, and no generic `test` task. The self-test pins the task
+ * pair against the real job's command.
+ *
  * ## Wiring
  *
  * Invoked from `.github/workflows/lint.yml` through its root alias, which runs
@@ -253,11 +283,12 @@ const SELF_TEST_BATTERIES = Object.freeze({
   // (see the header); the numbers below keep their names.
   '(9) Build Core and the build inputs turbo.json declares': 42,
   '(10) Build Core and the scripts its own steps run': 30,
+  '(11) Test Core and the generic test tasks\' root inputs': 18,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 9;
+const SELF_TEST_BATTERY_FLOOR = 10;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -666,10 +697,12 @@ export function judgeBuildInputs(source, turboSource, manifestSource, closureOf
   // populations alone: a LITERAL entry in a directory that holds a declared
   // literal build input or a guard is there for the same reason those are, so
   // one that covers none of them is a leftover -- of an input turbo.json
-  // dropped, or of a guard step Build Core dropped. Root-level files and
-  // pattern entries are not this subject's to judge -- nothing here says why
-  // they are in `core`.
-  const reasons = [...declared.rows, ...guards.rows];
+  // dropped, or of a guard step Build Core dropped. A generic test task's root
+  // input is a reason too (the fourth subject, #27961); a turbo.json without
+  // one only shrinks the reasons, which reports more, never less. Root-level
+  // files and pattern entries are not this subject's to judge -- nothing here
+  // says why they are in `core`.
+  const reasons = [...declared.rows, ...guards.rows, ...(testInputsOf(turbo).rows ?? [])];
   const reasonDirs = new Set(reasons.filter(({ path }) => !WILDCARD.test(path)).map(({ path }) => dirOf(path)).filter(Boolean));
   const stale = entries.filter(
     (entry) =>
@@ -722,10 +755,11 @@ function reportBuildInputs(verdict) {
   if (verdict.stale.length > 0) {
     problems.push(
       `${CI_WORKFLOW}'s \`${BUILD_FILTER}:\` filter carries literal entr(ies) beside the build inputs and Build Core's ` +
-        `guards that cover none of them -- left over from an input ${TURBO_CONFIG} no longer declares, or from a ` +
-        `script no \`${BUILD_JOB}\` step runs any more:\n` +
+        `guards that cover none of them, nor any generic test task's root input -- left over from an input ` +
+        `${TURBO_CONFIG} no longer declares, or from a script no \`${BUILD_JOB}\` step runs any more:\n` +
         verdict.stale.map((e) => `      ${e}`).join('\n') +
-        `\n    Delete them. Each one starts the whole core pipeline on a diff that neither a build nor Build Core reads.`,
+        `\n    Delete them. Each one starts the whole core pipeline on a diff that no build, no test task and no ` +
+        'Build Core step reads.',
     );
   }
   if (problems.length > 0) {
@@ -750,6 +784,92 @@ function reportBuildInputs(verdict) {
   return 0;
 }
 
+// ── The fourth subject: Test Core and the generic test tasks' root inputs (#27961) ──
+
+/**
+ * The generic turbo tasks Test Core runs for every package it tests: the step's
+ * `turbo run test test:repo`. The self-test pins this pair against the real job.
+ */
+export const TEST_TASKS = Object.freeze(['test', 'test:repo']);
+/** Where an uncovered generic test input belongs -- see the header for why not `crosspkg`. */
+export const TEST_REMEDY_FILTER = 'core';
+
+/**
+ * Every repo-root-relative `$TURBO_ROOT$/...` input of a TEST_TASKS task, each
+ * with the task that names it, or `{ refusal }`. Negated inputs are skipped, as
+ * for the build inputs: a negation can only narrow a hash.
+ */
+export function testInputsOf(turbo) {
+  const tasks = turbo?.tasks;
+  if (!tasks || typeof tasks !== 'object' || Array.isArray(tasks)) {
+    return { refusal: `${TURBO_CONFIG} declares no \`tasks\` map.` };
+  }
+  if (!tasks[TEST_TASKS[0]]) {
+    return { refusal: `${TURBO_CONFIG} declares no generic \`${TEST_TASKS[0]}\` task -- the test task Test Core runs has moved.` };
+  }
+  const byPath = new Map();
+  for (const task of TEST_TASKS) {
+    const inputs = Array.isArray(tasks[task]?.inputs) ? tasks[task].inputs : [];
+    for (const input of inputs) {
+      if (typeof input !== 'string' || !input.startsWith(TURBO_ROOT)) continue;
+      const path = input.slice(TURBO_ROOT.length);
+      byPath.set(path, [...(byPath.get(path) ?? []), task]);
+    }
+  }
+  return { rows: [...byPath].map(([path, from]) => ({ path, from })) };
+}
+
+/**
+ * The verdict on Test Core's scheduling against the generic test tasks' root
+ * inputs. Takes the two SOURCE STRINGS (null for one that could not be read);
+ * `{ refusal }` for every state in which the subject was not read.
+ */
+export function judgeTestInputs(source, turboSource) {
+  const read = readSchedulingFilters(source);
+  if (read.refusal) return read;
+  if (typeof turboSource !== 'string') return { refusal: `${TURBO_CONFIG} could not be read.` };
+  let turbo;
+  try {
+    turbo = JSON.parse(turboSource);
+  } catch (err) {
+    return { refusal: `${TURBO_CONFIG} could not be read as JSON: ${err?.message ?? err}` };
+  }
+  const declared = testInputsOf(turbo);
+  if (declared.refusal) return declared;
+  const covered = [];
+  const uncovered = [];
+  for (const row of declared.rows) {
+    const verdict = coverageVerdict(row.path, read.entries);
+    (verdict.covered ? covered : uncovered).push({ ...row, ...verdict });
+  }
+  return { condition: read.condition, inputs: declared.rows, covered, uncovered };
+}
+
+function reportTestInputs(verdict) {
+  if (verdict.refusal) {
+    console.error(`FAIL: check-ci-filter-parity could not judge Test Core's test inputs.\n\n  - ${verdict.refusal}\n`);
+    return 1;
+  }
+  if (verdict.uncovered.length > 0) {
+    console.error(
+      `FAIL: ci.yml's scheduling filters are out of step with the generic test tasks' root inputs.\n\n` +
+        `  - ${verdict.uncovered.length} root input(s) of ${TEST_TASKS.map((t) => `\`${t}\``).join(' / ')} in ${TURBO_CONFIG} are ` +
+        `covered by NEITHER ${SCHEDULING_FILTERS.map((n) => `\`${n}\``).join(' nor ')} in ${CI_WORKFLOW}. A diff confined to\n` +
+        `    one moves every package's test hash and starts no \`${SCHEDULED_JOB}\` job, so the merge queue is the first place\n` +
+        `    Test Core runs on it:\n` +
+        verdict.uncovered.map((r) => `      ${r.path}   (${r.from.join(', ')})`).join('\n') +
+        `\n    Add each one VERBATIM to the \`${TEST_REMEDY_FILTER}:\` filter in ${CI_WORKFLOW}. Not \`${REMEDY_FILTER}:\`, which is held to\n` +
+        '    the cross-package declarations, and not the subtree it sits in.\n',
+    );
+    return 1;
+  }
+  console.log(
+    `OK: all ${verdict.inputs.length} root input(s) of ${TEST_TASKS.map((t) => `\`${t}\``).join(' / ')} in ${TURBO_CONFIG} are ` +
+      `covered by ${SCHEDULING_FILTERS.map((n) => `\`${n}\``).join(' or ')}, which the \`${SCHEDULED_JOB}\` job's \`if:\` reads.`,
+  );
+  return 0;
+}
+
 function report(verdict) {
   if (verdict.refusal) {
     console.error(`FAIL: check-ci-filter-parity could not judge the scheduling filters.\n\n  - ${verdict.refusal}\n`);
@@ -817,7 +937,8 @@ export function main(root = REPO_ROOT, table = CROSS_PACKAGE_TEST_INPUTS) {
   const buildCode = reportBuildInputs(
     judgeBuildInputs(source, readOrNull(root, TURBO_CONFIG), readOrNull(root, ROOT_MANIFEST), closureIn(root)),
   );
-  return crosspkg === 0 && buildCode === 0 ? 0 : 1;
+  const testCode = reportTestInputs(judgeTestInputs(source, readOrNull(root, TURBO_CONFIG)));
+  return crosspkg === 0 && buildCode === 0 && testCode === 0 ? 0 : 1;
 }
 
 /** A root file's text, or null when it cannot be read -- the judge refuses on null by name. */
@@ -865,10 +986,21 @@ function list(root = REPO_ROOT, table = CROSS_PACKAGE_TEST_INPUTS) {
   }
   for (const entry of build.stale) console.log(`FAIL ${entry}   stale: covers no declared build input and no script a ${BUILD_JOB} step runs`);
   console.log(`left out (excluded by \`${BUILD_COMMAND}\`): ${build.excludedTasks.join(', ') || 'none'}`);
+
+  const test = judgeTestInputs(readFileSync(join(root, CI_WORKFLOW), 'utf8'), readOrNull(root, TURBO_CONFIG));
+  if (test.refusal) {
+    console.error(`FAIL: ${test.refusal}`);
+    return 1;
+  }
+  console.log(`\nroot inputs of ${TEST_TASKS.join(' / ')} in ${TURBO_CONFIG}, against ${SCHEDULING_FILTERS.join(' + ')} (${SCHEDULED_JOB}):`);
+  for (const row of [...test.covered, ...test.uncovered].sort((a, b) => a.path.localeCompare(b.path))) {
+    console.log(`${row.covered ? 'ok  ' : 'FAIL'} ${row.path}${row.covered ? `   via ${row.kind} ${row.via}` : ''}   (${row.from.join(', ')})`);
+  }
   return verdict.uncovered.length > 0 ||
     build.uncovered.length > 0 ||
     build.guardsUncovered.length > 0 ||
-    build.stale.length > 0
+    build.stale.length > 0 ||
+    test.uncovered.length > 0
     ? 1
     : 0;
 }
@@ -1607,6 +1739,96 @@ export async function selfTest() {
     `bound 2: the local composite action(s) Build Core uses (${localActions.join(', ') || 'none found'}) run no repository script -- got ${actionScripts.join(', ') || 'none'}`,
   );
 
+  // ── (11) Test Core and the generic test tasks' root inputs (#27961) ─────
+  battery('(11) Test Core and the generic test tasks\' root inputs');
+  const testTurbo = ({ tasks } = {}) =>
+    JSON.stringify({
+      tasks: tasks ?? {
+        build: { inputs: ['$TURBO_DEFAULT$'] },
+        test: { inputs: ['$TURBO_DEFAULT$', '$TURBO_ROOT$/vitest.preset.mts', '$TURBO_ROOT$/ui/vitest.config.mts', '!$TURBO_ROOT$/ui/skip.mts'] },
+        'test:repo': { inputs: ['$TURBO_DEFAULT$', '$TURBO_ROOT$/scripts/repo-scan.mjs'] },
+        '@objectstack/probe#test': { inputs: ['$TURBO_DEFAULT$', '$TURBO_ROOT$/docker/**'] },
+      },
+    });
+  const testWorkflow = (core = ['packages/**', 'vitest.preset.mts', 'ui/vitest.config.mts'], condition) =>
+    fixtureWorkflow({ core, crosspkg: ['scripts/**'], condition });
+  const uncoveredTestPaths = (v) => (v.uncovered ?? ['(no verdict)']).map((r) => r.path ?? r);
+
+  const testClean = judgeTestInputs(testWorkflow(), testTurbo());
+  assert(!testClean.refusal && uncoveredTestPaths(testClean).length === 0, `positive control: the synthetic tree's test inputs are all covered -- ${testClean.refusal ?? uncoveredTestPaths(testClean).join(', ')}`);
+  assert(
+    (testClean.inputs ?? []).map((r) => r.path).sort().join(',') === 'scripts/repo-scan.mjs,ui/vitest.config.mts,vitest.preset.mts',
+    '-- the population is the `test` and `test:repo` root inputs: a package task\'s input and a negated input are not in it',
+  );
+  assert(
+    testClean.covered?.find((r) => r.path === 'scripts/repo-scan.mjs')?.via === 'scripts/**',
+    '-- an input `crosspkg` covers is covered: the `test` job ORs both lists',
+  );
+
+  // THE HOLE the card reads: a generic test input neither list covers.
+  const testDropped = judgeTestInputs(testWorkflow(['packages/**', 'vitest.preset.mts']), testTurbo());
+  assert(
+    uncoveredTestPaths(testDropped).join(',') === 'ui/vitest.config.mts' && testDropped.uncovered[0].from.join(',') === 'test',
+    `a \`test\` root input dropped from \`core\` is reported by path and task -- got ${uncoveredTestPaths(testDropped).join(', ')}`,
+  );
+  const repoDropped = judgeTestInputs(testWorkflow(), testTurbo({ tasks: { test: { inputs: [] }, 'test:repo': { inputs: ['$TURBO_ROOT$/tools/scan.mjs'] } } }));
+  assert(
+    uncoveredTestPaths(repoDropped).join(',') === 'tools/scan.mjs' && repoDropped.uncovered[0].from.join(',') === 'test:repo',
+    `-- and so is a \`test:repo\` root input under a root no list names -- got ${uncoveredTestPaths(repoDropped).join(', ')}`,
+  );
+  assert(quietly(() => reportTestInputs(testDropped)) === 1 && quietly(() => reportTestInputs(testClean)) === 0, '-- and the report path returns 1 over the hole and 0 over the clean tree');
+
+  // Refusals: never a clean zero over a subject that was not read.
+  const testRefusal = (v) => typeof v.refusal === 'string' && v.refusal.length > 0;
+  assert(testRefusal(judgeTestInputs(testWorkflow(), null)), 'refuses when turbo.json could not be read');
+  assert(testRefusal(judgeTestInputs(testWorkflow(), '{ not json')), 'refuses when turbo.json is not JSON');
+  assert(testRefusal(judgeTestInputs(testWorkflow(), JSON.stringify({}))), 'refuses when turbo.json declares no `tasks` map');
+  assert(testRefusal(judgeTestInputs(testWorkflow(), testTurbo({ tasks: { build: {} } }))), 'refuses when turbo.json declares no generic `test` task');
+  assert(
+    testRefusal(judgeTestInputs(testWorkflow(undefined, "${{ !cancelled() && needs.filter.outputs.core != 'false' }}"), testTurbo())),
+    'refuses when the `test` job\'s `if:` stops naming `crosspkg`, as the first subject does',
+  );
+
+  // The population is a REASON for the third subject's leftover rule: a literal
+  // `core` row beside a build input that covers a test input is not a leftover.
+  const leftoverTurbo = (testInputs) =>
+    JSON.stringify({
+      tasks: {
+        build: { inputs: ['$TURBO_ROOT$/ui/tsconfig.json'] },
+        test: { inputs: testInputs },
+      },
+    });
+  const leftoverCore = ['packages/**', 'turbo.json', 'ui/tsconfig.json', 'ui/vitest.config.mts'];
+  const withTestReason = judgeBuildInputs(buildWorkflow({ core: leftoverCore }), leftoverTurbo(['$TURBO_ROOT$/ui/vitest.config.mts']), manifestFixture('turbo run build'));
+  assert(!withTestReason.refusal && (withTestReason.stale ?? ['(no verdict)']).length === 0, `a literal \`core\` row beside a build input that covers a test input is no leftover -- got ${withTestReason.refusal ?? withTestReason.stale.join(', ')}`);
+  const withoutTestReason = judgeBuildInputs(buildWorkflow({ core: leftoverCore }), leftoverTurbo([]), manifestFixture('turbo run build'));
+  assert((withoutTestReason.stale ?? []).join(',') === 'ui/vitest.config.mts', '-- and the same row IS one once turbo.json stops declaring that test input');
+
+  // The real tree: clean, and the five #27961 rows are what makes it so.
+  const realTurbo = readFileSync(join(REPO_ROOT, TURBO_CONFIG), 'utf8');
+  const realTest = judgeTestInputs(realSource, realTurbo);
+  assert(!realTest.refusal && uncoveredTestPaths(realTest).length === 0, `the checked-in tree's generic test inputs are all covered -- ${realTest.refusal ?? uncoveredTestPaths(realTest).join(', ')}`);
+  const TEST_ROWS = ['ui/vitest.config.mts', 'ui/vitest.setup.*', 'ui/scripts/test-shard-*', 'ui/apps/console/vitest.config.ts', 'ui/apps/console/vite.config.ts'];
+  let testRowsDropped = realSource;
+  for (const row of TEST_ROWS) testRowsDropped = testRowsDropped.replace(`              - '${row}'\n`, '');
+  assert(
+    TEST_ROWS.every((row) => !testRowsDropped.includes(`              - '${row}'\n`)) && TEST_ROWS.every((row) => realSource.includes(`              - '${row}'\n`)),
+    'the real-tree rollback found all five #27961 rows in the checked-in ci.yml and removed them',
+  );
+  assert(
+    uncoveredTestPaths(judgeTestInputs(testRowsDropped, realTurbo)).sort().join(',') === [...TEST_ROWS].sort().join(','),
+    'the checked-in ci.yml with the five #27961 rows dropped reports exactly those five, and nothing else',
+  );
+  assert(inScratchTree(testRowsDropped, (root) => quietly(() => main(root))) === 1, '-- and main() returns 1 over it: the report path, not only `judgeTestInputs`');
+
+  // The bound the header states: TEST_TASKS is the pair the real job runs.
+  const realTestRuns = (parse(realSource)?.jobs?.[SCHEDULED_JOB]?.steps ?? []).map((s) => String(s?.run ?? ''));
+  const turboTaskLists = realTestRuns.flatMap((r) => [...r.matchAll(/pnpm turbo run (test(?::[\w-]+)?(?:\s+[a-z][\w:-]*)*)\s+\$FILTERS/g)].map((m) => m[1].trim()));
+  assert(
+    turboTaskLists.length > 0 && turboTaskLists.every((t) => t === TEST_TASKS.join(' ')),
+    `bound: every whole-package test \`turbo run\` the real \`${SCHEDULED_JOB}\` job makes names exactly ${TEST_TASKS.join(' ')} -- got ${JSON.stringify(turboTaskLists)}`,
+  );
+
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ───
   //
   // Evaluated after every battery has had its chance and BEFORE the verdict, so
@@ -1673,7 +1895,11 @@ export async function selfTest() {
       `row each observed red by path and step, through an alias, an alias chain, a direct path and an import, a ` +
       `commented-out line requiring nothing, a row whose step is gone reported as a leftover, an unresolvable ` +
       `script refused, the five real guards and the imported population-floor covered by their own rows, the ` +
-      `lean-entry row dropped observed red through the report path, and both recognizer bounds pinned to the real job.`,
+      `lean-entry row dropped observed red through the report path, and both recognizer bounds pinned to the real job; ` +
+      `and Test Core's generic test inputs: a \`test\` and a \`test:repo\` root input each observed red by path and task, ` +
+      `one covered only by \`crosspkg\`, package-task and negated inputs left out, five refusals, a test input keeping a ` +
+      `\`core\` row beside a build input from reading as a leftover, the checked-in tree green with the five #27961 rows ` +
+      `dropped observed red through the report path, and the task pair pinned to the real job.`,
   );
   selfTestReachedVerdict = true;
   return 0;