diff --git a/packages/client/src/envelope-caller-census.test.ts b/packages/client/src/envelope-caller-census.test.ts
index 03d7789e4b..636228e498 100644
--- a/packages/client/src/envelope-caller-census.test.ts
+++ b/packages/client/src/envelope-caller-census.test.ts
@@ -105,14 +105,19 @@
  *  - **`objectui` is a RECORDED constant, not a live scan.** A test in this
  *    repo cannot read that checkout. `OBJECTUI_CENSUS` carries the revision it
  *    was measured at and the command that reproduces it.
- *  - **The ratchet in section 3 is only as live as turbo's cache.** This suite
- *    walks the whole workspace, but `@objectstack/client#test` declares as
- *    inputs its own package plus the named cross-package files — NOT every
- *    tree it reads. So a new call site added in ANOTHER package can leave this
- *    suite cached-green until something else invalidates it. Declaring
- *    `packages/**` here would re-run the client suite on virtually every
- *    commit, which is why it is recorded as a known bound rather than bought
- *    at that price: on a cold cache and in CI's full run the count is exact,
+ *  - **The ratchet in section 3 is only as live as turbo's cache — for the
+ *    trees still undeclared.** This suite walks the whole workspace, while
+ *    `@objectstack/client#test` declares as inputs its own package plus the
+ *    named cross-package globs — NOT every tree it reads. [#15608] `scripts/**`
+ *    is now one of those globs, declared in
+ *    `scripts/cross-package-test-inputs.mjs` and mirrored into `turbo.json`, so
+ *    a diff under that root both pulls this package into CI's PR-side affected
+ *    set (Layer A, the `--union-into` step) and moves this task's cache hash
+ *    (Layer B). ⛔ `packages/**` is still NOT declared: it would re-run the
+ *    client suite on virtually every commit, so it stays a recorded bound
+ *    rather than one bought at that price — a new call site added in another
+ *    PACKAGE can still leave this suite cached-green until something else
+ *    invalidates it. On a cold cache and in CI's full run the count is exact,
  *    and a call site added inside `packages/client` — where every site lives
  *    today — invalidates normally.
  */
@@ -269,9 +274,16 @@ const CENSUS = scanCallSites(REPO_ROOT);
  * What made that expensive was never the count. It was the FAILURE TEXT. It
  * read `expected 21 to be 19` and said nothing about strings, masking or gate
  * scripts — in a package the author had not edited, naming a ledger the author
- * had never read, at the most expensive point in the pipeline, and invisible
- * to every local gate a `scripts/**` edit derives. So the count stands exactly
- * as it was, and the message explains itself.
+ * had never read, and at the most expensive point in the pipeline. So the
+ * count stands exactly as it was, and the message explains itself.
+ *
+ * [#15608] ⭐ The LAST clause of that sentence used to read "and invisible to
+ * every local gate a `scripts/**` edit derives", and it is no longer true: this
+ * package now declares `scripts/**` as a cross-package test input, so such a
+ * diff selects this suite on the PR-side run instead of first reporting from
+ * the merge queue. That is the WHEN-it-runs axis only — what the census COUNTS
+ * is untouched, and #13874's suspension of the literal/context distinction
+ * stands exactly as written above.
  *
  * ## Three properties this note must have, and what buys each
  *
diff --git a/scripts/cross-package-test-inputs.mjs b/scripts/cross-package-test-inputs.mjs
index 078aff2ddd..065e771576 100644
--- a/scripts/cross-package-test-inputs.mjs
+++ b/scripts/cross-package-test-inputs.mjs
@@ -517,7 +517,49 @@ export const CROSS_PACKAGE_TEST_INPUTS = {
       // count changes if the mask does.
       'scripts/js-comment-mask.mjs',
       'scripts/js-comment-mask.d.mts',
+      // [#15608] ⭐ THE WHOLE-REPO WALK, declared for the root the incident came
+      // from. `envelope-caller-census.test.ts` resolves the workspace root and
+      // walks EVERY `.ts` / `.tsx` / `.js` / `.mjs` / `.cjs` file in the tree at
+      // module load, so its inputs are the repo -- but the two globs above name
+      // only the mask it imports, and `turbo ls --affected` reaches this package
+      // from the dependency graph alone. A diff under `scripts/` therefore
+      // selected this package for NOTHING, and the census could not report until
+      // the merge queue.
+      //
+      // Measured, not modelled: PR #13596 added a gate refusal MESSAGE containing
+      // two `client.analytics.query(` call shapes. It masks comments and
+      // leaves string literals intact by design (#13874, suspended and NOT
+      // reopened here -- what it counts is unchanged), so it counted them:
+      // `expected 21 to be 19`. That PR touched `scripts/` and nothing else, so
+      // no PR-side run could have reddened; it reddened in the merge queue, where
+      // speculative stacking ejected five PRs, four of them bystanders inheriting
+      // the same count off the stacked tree.
+      //
+      // `scripts/**` and not the whole census radius, and the difference is a
+      // PRICE, not an oversight. Layer B mirrors every glob here into
+      // `@objectstack/client#test` inputs, so a declared `packages/**` would
+      // re-run this suite on virtually every commit -- the bound that test's
+      // header has recorded as declined since #13079, and this entry does not
+      // buy it. `scripts/**` is the root where a QUOTED example lives (refusal
+      // messages, usage banners, embedded fixtures) and the one the incident
+      // came from; it also needs no ci.yml `crosspkg:` filter change, because
+      // `@objectstack/spec` already declares it verbatim, so Layer C reaches it
+      // today. What stays uncovered stays recorded in that test's header.
+      'scripts/**',
     ],
+    heldBy: {
+      // `scripts/**` is rostered TODAY through the census's own
+      // `scripts/js-comment-mask.mjs` import, so this witness is not what makes
+      // the glob held -- it is what keeps the glob attributed to the read that
+      // actually needs it. The walk is seeded from a recognised expression and
+      // then descends on a LOOP VARIABLE, so it resolves an escape verdict and
+      // NO name (`pathExpression`): if the mask import ever moves, the roster
+      // loses `scripts/` entirely while the whole-repo walk goes right on
+      // reading it, and #10566's limb would name this glob rather than the read.
+      // The witness is checked -- this test must still be one of this package's
+      // escaping tests -- so it cannot rot into prose.
+      'scripts/**': ['packages/client/src/envelope-caller-census.test.ts'],
+    },
   },
   '@objectstack/lint': {
     // authoring-rule-wiring / validate-rule-compilability /
diff --git a/turbo.json b/turbo.json
index 8b4b4a0a62..a89f287450 100644
--- a/turbo.json
+++ b/turbo.json
@@ -150,7 +150,8 @@
         "$TURBO_ROOT$/packages/plugins/plugin-auth/src/auth-route-ledger.conformance.test.ts",
         "$TURBO_ROOT$/scripts/check-route-envelope.mjs",
         "$TURBO_ROOT$/scripts/js-comment-mask.mjs",
-        "$TURBO_ROOT$/scripts/js-comment-mask.d.mts"
+        "$TURBO_ROOT$/scripts/js-comment-mask.d.mts",
+        "$TURBO_ROOT$/scripts/**"
       ]
     },
     "@objectstack/lint#test": {