diff --git a/.github/actions/prepare-git-compatibility/action.yml b/.github/actions/prepare-git-compatibility/action.yml
new file mode 100644
index 00000000000..dce54649421
--- /dev/null
+++ b/.github/actions/prepare-git-compatibility/action.yml
@@ -0,0 +1,30 @@
+name: Prepare baseline Git compatibility binary
+description: Restore or build the pinned Linux Git binary for the compatibility contract.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache baseline Git build
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/orca-git-compat/git-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+
+    # Finish the CPU-heavy build before any timed compatibility lanes start.
+    - name: Build the baseline Git binary
+      shell: bash
+      run: |
+        archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+        source="$HOME/.cache/orca-git-compat/git-2.25.5"
+        if [ -x "$source/git" ]; then
+          exit 0
+        fi
+        curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+        echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+          | sha256sum --check
+        mkdir -p "$source"
+        tar -xzf "$archive" -C "$source" --strip-components=1
+        make -C "$source" -j"$(nproc)" \
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+        # Object files are no longer needed after linking the cached binary.
+        find "$source" -name '*.o' -delete
diff --git a/.github/workflows/ci-cache-warmup.yml b/.github/workflows/ci-cache-warmup.yml
new file mode 100644
index 00000000000..9066dd266a3
--- /dev/null
+++ b/.github/workflows/ci-cache-warmup.yml
@@ -0,0 +1,65 @@
+name: Warm shared CI caches
+
+on:
+  schedule:
+    - cron: '41 * * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/actions/prepare-git-compatibility/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'config/tsconfig*.json'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/patches/node-pty@1.1.0.patch'
+      - 'config/patches/@vscode__windows-process-tree@0.8.0.patch'
+      - 'native/windows-registry/**'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/prepare-git-compatibility/**'
+      - 'config/scripts/ci-cache-warmup-workflow.test.mjs'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-cache-warmup-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      # Default-branch caches can be restored by every PR; PR caches cannot.
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+
+      - uses: ./.github/actions/prepare-git-compatibility
+
+      - name: Cache TypeScript incremental state
+        id: typecheck-cache
+        uses: actions/cache@v5
+        with:
+          path: config/*.tsbuildinfo
+          key: tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-${{ github.sha }}
+          restore-keys: |
+            tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-
+
+      - name: Refresh TypeScript state for this commit
+        if: steps.typecheck-cache.outputs.cache-hit != 'true'
+        run: pnpm run typecheck
diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml
index 6191552dab9..02f2d1822ec 100644
--- a/.github/workflows/cloud-verify.yml
+++ b/.github/workflows/cloud-verify.yml
@@ -32,7 +32,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+
+      # Scan every ancestor of HEAD without downloading unrelated branch/tag histories.
+      - name: Fetch complete scan history
+        working-directory: .
+        run: |
+          git fetch --no-tags --unshallow origin "$GITHUB_SHA"
+          test "$(git rev-parse --is-shallow-repository)" = false
 
       - name: Scan Cloud history reachable from HEAD with Gitleaks
         run: >-
diff --git a/.github/workflows/git-command-termination-runtime.yml b/.github/workflows/git-command-termination-runtime.yml
index 1602bae956a..6b49177ed56 100644
--- a/.github/workflows/git-command-termination-runtime.yml
+++ b/.github/workflows/git-command-termination-runtime.yml
@@ -7,6 +7,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: git-command-termination-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   windows-exit:
     runs-on: windows-latest
diff --git a/.github/workflows/issue-os-labeler.yaml b/.github/workflows/issue-os-labeler.yaml
index c437db7f21a..cf0ee59a842 100644
--- a/.github/workflows/issue-os-labeler.yaml
+++ b/.github/workflows/issue-os-labeler.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   apply-os-label:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Apply OS label from issue form
diff --git a/.github/workflows/pi-owner-runtime.yml b/.github/workflows/pi-owner-runtime.yml
index 9f9df4f9b0b..592bc75bb5e 100644
--- a/.github/workflows/pi-owner-runtime.yml
+++ b/.github/workflows/pi-owner-runtime.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: pi-owner-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pi-provider-runtime.yml b/.github/workflows/pi-provider-runtime.yml
index 837c38baf9a..31046737499 100644
--- a/.github/workflows/pi-provider-runtime.yml
+++ b/.github/workflows/pi-provider-runtime.yml
@@ -7,6 +7,9 @@ on:
       - '.github/workflows/pi-provider-runtime.yml'
 permissions:
   contents: read
+concurrency:
+  group: pi-provider-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pr-test-loc.yml b/.github/workflows/pr-test-loc.yml
index a884aedc636..fb2934d1f73 100644
--- a/.github/workflows/pr-test-loc.yml
+++ b/.github/workflows/pr-test-loc.yml
@@ -19,7 +19,8 @@ permissions:
 jobs:
   loc:
     name: test vs non-test LoC
-    runs-on: ubuntu-latest
+    # API calls and a small Node script fit the free single-CPU container runner.
+    runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
       # Why no checkout: the Files API already has per-file additions/deletions.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 6ac6de78ed3..781617d0116 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -23,8 +23,10 @@ jobs:
   # Per-job outputs also skip git-compat/xterm/packaging/shell when those
   # inputs are unchanged; empty diffs fail closed and run everything.
   code_paths:
-    name: detect code-relevant changes
-    runs-on: ubuntu-latest
+    name: detect changes and check repository guards
+    # Reuse one lightweight checkout for detection and the always-required guards.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     outputs:
       should_run: ${{ steps.filter.outputs.should_run }}
       native_cache_changed: ${{ steps.filter.outputs.native_cache_changed }}
@@ -56,8 +58,27 @@ jobs:
           # few this job actually reads on demand.
           fetch-depth: 0
           filter: blob:none
+          sparse-checkout: |
+            /package.json
+            /README.md
+            /docs/readme/
+            /.github/scripts/check-root-directory-entries.mjs
+            /config/scripts/check-readme-local-links.mjs
+            /config/scripts/pr-code-change-scope.mjs
+            /config/scripts/pr-e2e-source-routing.mjs
+          sparse-checkout-cone-mode: false
           persist-credentials: false
 
+      - name: Reject new root-level files and folders
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: node .github/scripts/check-root-directory-entries.mjs "$BASE_SHA" "$HEAD_SHA"
+
+      # The full Git index retains link targets outside the sparse working tree.
+      - name: Check README local links
+        run: node config/scripts/check-readme-local-links.mjs
+
       - name: Classify changed paths
         id: filter
         env:
@@ -249,37 +270,11 @@ jobs:
       - name: Verify macOS entitlements
         run: pnpm verify:macos-entitlements
 
-  root_directory_guard:
-    name: root directory guard
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
-          persist-credentials: false
-
-      - name: Reject new root-level files and folders
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: node .github/scripts/check-root-directory-entries.mjs "$BASE_SHA" "$HEAD_SHA"
-
-      # Why here: the READMEs embed media owned by docs/site and resources/onboarding,
-      # and the classifier skips static_analysis for docs-only diffs. This job runs
-      # on every PR and needs no install.
-      - name: Check README local links
-        run: node config/scripts/check-readme-local-links.mjs
-
   typecheck:
     needs: [code_paths]
     if: needs.code_paths.outputs.typecheck == 'true'
-    runs-on: ubuntu-latest
+    # Typechecking uses no native runtime, so it can use the free public ARM runner.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -317,39 +312,7 @@ jobs:
 
       - uses: ./.github/actions/install-node-dependencies
 
-      # Why: the 2.25.5 lane is a source build of a pinned tarball, so it produced the
-      # same binary on every PR for minutes of runner time. The key carries the version
-      # because that is the only input; the sha256 assertion below still guards the
-      # tarball on the miss path that actually builds. Only this PR's own later pushes
-      # can restore it — GitHub scopes a cache written from a pull_request run to that
-      # ref — so a first push always takes the build path below.
-      - name: Cache baseline Git build
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/orca-git-compat/git-2.25.5
-          key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
-
-      # Why its own step: this is `make -j$(nproc)` on every core, and the lanes below
-      # spend their wall clock waiting on container starts, not on Git. Sharing a runner
-      # with the build stretched one ~1.5s boundary case past Vitest's 30s timeout, so
-      # the build has to finish before anything timed starts.
-      - name: Build the baseline Git binary
-        run: |
-          archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
-          source="$HOME/.cache/orca-git-compat/git-2.25.5"
-          if [ -x "$source/git" ]; then
-            exit 0
-          fi
-          curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
-          echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
-            | sha256sum --check
-          mkdir -p "$source"
-          tar -xzf "$archive" -C "$source" --strip-components=1
-          make -C "$source" -j"$(nproc)" \
-            NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
-          # Why: the linked binaries are what the next run needs; the objects that
-          # produced them are most of the tree and would bloat the cache entry.
-          find "$source" -name '*.o' -delete
+      - uses: ./.github/actions/prepare-git-compatibility
 
       - name: Verify Git binary compatibility matrix
         run: |
@@ -603,8 +566,9 @@ jobs:
 
   test:
     needs: [code_paths, test_native_cache]
+    # Honor cancellation while allowing the optional native-cache primer to skip.
     if: >-
-      always() &&
+      !cancelled() &&
       needs.code_paths.outputs.test == 'true' &&
       (needs.test_native_cache.result == 'success' || needs.test_native_cache.result == 'skipped')
     uses: ./.github/workflows/unit-tests.yml
@@ -1089,11 +1053,10 @@ jobs:
       ref: ${{ github.event.pull_request.head.sha }}
 
   verify:
-    if: always()
+    if: ${{ !cancelled() }}
     needs:
       - code_paths
       - static_analysis
-      - root_directory_guard
       - typecheck
       - git_compatibility
       - codex_index_heal_contract
@@ -1106,7 +1069,9 @@ jobs:
       - managed_hook_node18
       - package
       - package_windows
-    runs-on: ubuntu-latest
+    # Evaluating job results only needs the lightweight container runner.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
 
     steps:
       # Why: e2e is deliberately absent from needs. The suite is currently red on
@@ -1123,7 +1088,6 @@ jobs:
           SHOULD_RUN: ${{ needs.code_paths.outputs.should_run }}
           STATIC_ANALYSIS: ${{ needs.static_analysis.result }}
           STATIC_ANALYSIS_SHOULD_RUN: ${{ needs.code_paths.outputs.static_analysis }}
-          ROOT_DIRECTORY_GUARD: ${{ needs.root_directory_guard.result }}
           TYPECHECK: ${{ needs.typecheck.result }}
           TYPECHECK_SHOULD_RUN: ${{ needs.code_paths.outputs.typecheck }}
           GIT_COMPATIBILITY: ${{ needs.git_compatibility.result }}
@@ -1152,9 +1116,6 @@ jobs:
           if [ "$CODE_PATHS" != "success" ]; then
             exit 1
           fi
-          if [ "$ROOT_DIRECTORY_GUARD" != "success" ]; then
-            exit 1
-          fi
           if [ "$SHOULD_RUN" != "true" ]; then
             echo "Docs-only change; expensive PR checks skipped."
           fi
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 8014145939b..e6ab98f0d0d 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   enforce:
     if: github.repository == 'stablyai/orca'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Enforce release policy
diff --git a/.github/workflows/track-community-prs.yaml b/.github/workflows/track-community-prs.yaml
index 5a5dcb670c2..7a588663fb2 100644
--- a/.github/workflows/track-community-prs.yaml
+++ b/.github/workflows/track-community-prs.yaml
@@ -15,7 +15,8 @@ permissions:
 
 jobs:
   track-community-pr:
-    runs-on: ubuntu-latest
+    # API-only bookkeeping fits the free single-CPU container runner.
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Generate bufo-bot token
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 4ed5063e318..73748238f5f 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -33,9 +33,6 @@ jobs:
           native-runtime: node
           node-version: ${{ matrix.node }}
           cache-electron-package: 'true'
-          cache-dependency-path: |
-            pnpm-lock.yaml
-            cloud/pnpm-lock.yaml
 
       - name: Install Electron package binary for tests
         run: node config/scripts/install-electron-package-binary.mjs
diff --git a/config/scripts/build-mobile-web-app-bundle.test.mjs b/config/scripts/build-mobile-web-app-bundle.test.mjs
index cd56aa98c0a..1b095416708 100644
--- a/config/scripts/build-mobile-web-app-bundle.test.mjs
+++ b/config/scripts/build-mobile-web-app-bundle.test.mjs
@@ -2,6 +2,7 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { deserialize, serialize } from 'node:v8'
 import { describe, expect, it } from 'vitest'
 import {
   MOBILE_WEB_APP_NATIVE_PARITY_STYLE,
@@ -74,6 +75,25 @@ async function withScratch(run) {
   }
 }
 
+// Snapshots preserve Buffer methods and give each assertion its own mutable copy.
+let appBundleSnapshot
+let writtenBundleSnapshot
+
+async function readAppBundle() {
+  appBundleSnapshot ??= bundleMobileWebApp().then(serialize)
+  // Deserialized Buffers alias their snapshot, so copy it before exposing them.
+  return deserialize(Buffer.from(await appBundleSnapshot))
+}
+
+async function readWrittenBundle() {
+  writtenBundleSnapshot ??= withScratch(async (scratch) => {
+    const { outDir, ...result } = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
+    const html = await readFile(join(outDir, 'index.html'), 'utf8')
+    return serialize({ ...result, html })
+  })
+  return deserialize(await writtenBundleSnapshot)
+}
+
 describe('the CRLF pin', () => {
   it('exempts the same extensions in .gitattributes as the CRLF scan skips', async () => {
     const attributes = await readFile(join(projectDir, '.gitattributes'), 'utf8')
@@ -91,8 +111,23 @@ describe('the CRLF pin', () => {
 })
 
 describeBundling('the app bundle', () => {
+  it('isolates read-only fixture consumers from mutations in another assertion', async () => {
+    const first = await readAppBundle()
+    const original = first.script[0]
+    first.script[0] ^= 255
+    first.chunks.length = 0
+    first.routeKeys.length = 0
+    const next = await readAppBundle()
+    expect(next.script[0]).toBe(original)
+    expect(next.chunks.length).toBeGreaterThan(0)
+    expect(next.routeKeys.length).toBeGreaterThan(0)
+    const written = await readWrittenBundle()
+    written.manifest.assets.length = 0
+    expect((await readWrittenBundle()).manifest.assets.length).toBeGreaterThan(0)
+  }, 120_000)
+
   it('resolves react-native to react-native-web and leaves no require.context', async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     for (const source of sources) {
       expect(source).not.toContain('require.context')
     }
@@ -101,7 +136,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('cuts the routes into chunks the entry does not load', async () => {
-    const { script, chunks, entryStaticBytes } = await bundleMobileWebApp()
+    const { script, chunks, entryStaticBytes } = await readAppBundle()
     expect(chunks.length).toBeGreaterThan(1)
     // The entry's own bytes plus the chunks it imports statically, which is what the browser
     // parses before any route paints. Every route chunk is outside it.
@@ -112,7 +147,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('names the chunk each route lands in', async () => {
-    const { chunks, routeChunks, routeKeys } = await bundleMobileWebApp()
+    const { chunks, routeChunks, routeKeys } = await readAppBundle()
     expect(Object.keys(routeChunks).sort()).toEqual([...routeKeys].sort())
     const emitted = new Set(chunks.map((chunk) => chunk.name))
     for (const [key, name] of Object.entries(routeChunks)) {
@@ -202,7 +237,7 @@ describeBundling('the app bundle', () => {
   )
 
   it('bundles every route module', async () => {
-    const { routeKeys } = await bundleMobileWebApp()
+    const { routeKeys } = await readAppBundle()
     expect(routeKeys).toEqual(await collectMobileWebAppRouteKeys(appDir))
   }, 120_000)
 
@@ -274,7 +309,7 @@ describeBundling('the app bundle', () => {
   }, 240_000)
 
   it("names an output the same way the manifest's own asset hash does", async () => {
-    const { script, chunks } = await bundleMobileWebApp()
+    const { script, chunks } = await readAppBundle()
     // The name is embedded in the importer, so it cannot be recomputed later; this is what says
     // the name inside the bytes and the manifest's sha256 of those bytes are the same string.
     expect(hashedAsset(script, 'js').path).toBe(`assets/${sha256Hex(script)}.js`)
@@ -330,7 +365,7 @@ describeBundling('the app bundle', () => {
     // once per call. The file explorer calls triggerSelection on every row tap, and C1.9 already
     // traced a swallowed long press on the worktree list to that stray click. `haptics.web.ts` is
     // what keeps the whole shim out of the bundle, so this reads the bytes rather than the import.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       // The shim's own fingerprint, not `navigator.vibrate`: react-native-web's Vibration export
       // calls that too, and it touches no DOM until something invokes it.
       expect(source).not.toContain('ariaHidden')
@@ -340,7 +375,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it("ships react-native-web's hairline at one device pixel, whichever of its builds resolves", async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     // Minified, so the assignment reads `<name>.hairlineWidth=`; RNW's own value is the literal 1.
     const assignments = sources.flatMap(
       (source) => source.match(/\.hairlineWidth=[^;]{0,120}/g) ?? []
@@ -354,7 +389,7 @@ describeBundling('the app bundle', () => {
   it('embeds no absolute path from this checkout', async () => {
     // Every chunk, not only the entry: the route manifest names each route by absolute path, and
     // the chunk that import resolves to is where such a path would survive.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       expect(source).not.toContain(projectDir)
     }
   }, 120_000)
@@ -370,76 +405,56 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('loads the entry as a module, so its route imports resolve', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'module-tag')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // import() in a classic script is a syntax error, so the tag and the format are one fact.
-      expect(html).toContain('<script type="module" src="/assets/')
-      const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
-      expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // import() in a classic script is a syntax error, so the tag and the format are one fact.
+    expect(html).toContain('<script type="module" src="/assets/')
+    const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
+    expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
   }, 120_000)
 
   it('declares an icon, so no browser asks the shell for one', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'icon')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
-      // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
-      expect(html).toContain('<link rel="icon" href="data:," />')
-      // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
-      // naming one would point at a route image whose name changes with its bytes.
-      expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
+    // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
+    expect(html).toContain('<link rel="icon" href="data:," />')
+    // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
+    // naming one would point at a route image whose name changes with its bytes.
+    expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
   }, 120_000)
 
   it('declares no viewport-fit, because the shell owns the safe area', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'viewport')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // The shell pads the WebView out of the system bars, so the page has nothing to extend
-      // under; asking to would invite a second pad from every page-side SafeAreaView.
-      expect(html).toContain(
-        '<meta name="viewport" content="width=device-width, initial-scale=1" />'
-      )
-      expect(html).not.toContain('viewport-fit')
-    })
+    const { html } = await readWrittenBundle()
+    // The shell pads the WebView out of the system bars, so the page has nothing to extend
+    // under; asking to would invite a second pad from every page-side SafeAreaView.
+    expect(html).toContain('<meta name="viewport" content="width=device-width, initial-scale=1" />')
+    expect(html).not.toContain('viewport-fit')
   }, 120_000)
 
   it('carries the root reset, so the mounted tree has a height to be 1 of', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'root-reset')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
-      expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
-      // Literals rather than substrings taken off the constant, which would read it back against
-      // itself and follow any rule dropped from it. Every rule, because the chain is only as
-      // definite as its weakest link: a height on #root alone resolves against a body that has
-      // none, and percent of auto is auto. Named one by one so a failure says which rule went.
-      for (const rule of [
-        'html,body{height:100%}',
-        'body{overflow:hidden}',
-        '#root{display:flex;height:100%;flex:1}'
-      ]) {
-        expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
-      }
-      // The id travels with the rules: it is what marks this block as the template's reset rather
-      // than something the page grew its own copy of.
-      expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
-      // In the document itself, not a linked asset: the CSP that allows it is the one already
-      // relaxed for react-native-web's runtime sheet.
-      expect(html).not.toContain('<link rel="stylesheet"')
-    })
+    const { html } = await readWrittenBundle()
+    expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
+    expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
+    // Literals rather than substrings taken off the constant, which would read it back against
+    // itself and follow any rule dropped from it. Every rule, because the chain is only as
+    // definite as its weakest link: a height on #root alone resolves against a body that has
+    // none, and percent of auto is auto. Named one by one so a failure says which rule went.
+    for (const rule of [
+      'html,body{height:100%}',
+      'body{overflow:hidden}',
+      '#root{display:flex;height:100%;flex:1}'
+    ]) {
+      expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
+    }
+    // The id travels with the rules: it is what marks this block as the template's reset rather
+    // than something the page grew its own copy of.
+    expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
+    // In the document itself, not a linked asset: the CSP that allows it is the one already
+    // relaxed for react-native-web's runtime sheet.
+    expect(html).not.toContain('<link rel="stylesheet"')
   }, 120_000)
 
   it('writes the manifest shape the packaging contract reads', async () => {
-    const { manifest } = await withScratch((scratch) =>
-      buildMobileWebAppBundle({ outDir: join(scratch, 'c') })
-    )
+    const { manifest } = await readWrittenBundle()
     expect(manifest.schemaVersion).toBe(1)
     expect(manifest.entrypoint).toBe('index.html')
     expect(manifest.assets.map((asset) => asset.path)).toContain('index.html')
@@ -457,9 +472,8 @@ describe('the Phase C budget', () => {
   itBundling(
     'is not already exceeded by the current bundle',
     async () => {
-      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } = await withScratch(
-        (scratch) => buildMobileWebAppBundle({ outDir: join(scratch, 'd') })
-      )
+      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } =
+        await readWrittenBundle()
       expect(manifest.totalBytes).toBeLessThanOrEqual(MOBILE_WEB_APP_BUNDLE_MAX_TOTAL_BYTES)
       expect(manifest.assets.length).toBeLessThanOrEqual(
         mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
@@ -596,9 +610,7 @@ describe('the Phase C budget', () => {
   itBundling(
     'keeps the derived ceiling under the map the phone actually holds',
     async () => {
-      const { manifest, routeKeys, imageCount } = await withScratch((scratch) =>
-        buildMobileWebAppBundle({ outDir: join(scratch, 'e') })
-      )
+      const { manifest, routeKeys, imageCount } = await readWrittenBundle()
       const ceiling = mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
       expect(manifest.assets.length).toBeLessThanOrEqual(ceiling)
       // The native side refuses a manifest past this, so the derived ceiling has to stay inside it.
diff --git a/config/scripts/check-readme-local-links.test.mjs b/config/scripts/check-readme-local-links.test.mjs
index 2f7cfc76c92..e1d69723ee5 100644
--- a/config/scripts/check-readme-local-links.test.mjs
+++ b/config/scripts/check-readme-local-links.test.mjs
@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -75,6 +75,25 @@ describe('README local link check', () => {
     expect(findBrokenReadmeLinks(makeFixture(validReadmes))).toEqual([])
   })
 
+  it('checks tracked media outside the detector sparse checkout', () => {
+    const root = makeFixture(validReadmes)
+    const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
+    const checkout = workflow.jobs.code_paths.steps.find((step) =>
+      step.uses?.startsWith('actions/checkout@')
+    )
+    const patterns = checkout.with['sparse-checkout'].trim().split('\n')
+    expect(checkout.with['sparse-checkout-cone-mode']).toBe(false)
+    git(root, ['sparse-checkout', 'set', '--no-cone', ...patterns])
+
+    expect(existsSync(path.join(root, 'resources/build/icon.png'))).toBe(false)
+    expect(findBrokenReadmeLinks(root)).toEqual([])
+    git(root, ['update-index', '--force-remove', 'resources/build/icon.png'])
+    expect(findBrokenReadmeLinks(root).map((link) => link.resolved)).toEqual([
+      'resources/build/icon.png',
+      'resources/build/icon.png'
+    ])
+  })
+
   it('reports a deleted media file for the root and translated READMEs', () => {
     const { 'docs/site/public/docs/tab-split.gif': _gif, ...files } = validReadmes
     vi.spyOn(console, 'error').mockImplementation(() => {})
@@ -139,14 +158,15 @@ describe('README local link check', () => {
 
   // Why the ungated job: static_analysis is skipped for docs-only diffs, which is
   // exactly the kind of PR that deletes a docs-site GIF the README embeds.
-  it('runs on every PR through the ungated guard job and in the lint script', () => {
+  it('runs on every PR through the ungated detector and in the lint script', () => {
     const { scripts } = JSON.parse(readFileSync(path.join(projectDir, 'package.json'), 'utf8'))
     const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const step = guardJob.steps.find((candidate) => candidate.name === 'Check README local links')
 
     expect(guardJob.if).toBeUndefined()
     expect(guardJob.needs).toBeUndefined()
+    expect(step.if).toBeUndefined()
     expect(step.run).toBe('node config/scripts/check-readme-local-links.mjs')
     expect(scripts['check:readme-local-links']).toBe(
       'node config/scripts/check-readme-local-links.mjs'
diff --git a/config/scripts/check-root-directory-entries.test.mjs b/config/scripts/check-root-directory-entries.test.mjs
index dcc5596771b..f606d5623fd 100644
--- a/config/scripts/check-root-directory-entries.test.mjs
+++ b/config/scripts/check-root-directory-entries.test.mjs
@@ -221,14 +221,15 @@ describe('root directory guard', () => {
 
   it('is wired into the PR verify gate', () => {
     const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const guardStep = guardJob.steps.find(
       (step) => step.name === 'Reject new root-level files and folders'
     )
 
-    expect(guardJob.name).toBe('root directory guard')
+    expect(guardJob.if).toBeUndefined()
+    expect(guardStep.if).toBeUndefined()
     expect(guardJob.steps[0].with['fetch-depth']).toBe(0)
     expect(guardStep.run).toContain('node .github/scripts/check-root-directory-entries.mjs')
-    expect(workflow.jobs.verify.needs).toContain('root_directory_guard')
+    expect(workflow.jobs.verify.needs).toContain('code_paths')
   })
 })
diff --git a/config/scripts/ci-cache-warmup-workflow.test.mjs b/config/scripts/ci-cache-warmup-workflow.test.mjs
new file mode 100644
index 00000000000..e3fa25f7ead
--- /dev/null
+++ b/config/scripts/ci-cache-warmup-workflow.test.mjs
@@ -0,0 +1,40 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const readWorkflow = (name) =>
+  parse(readFileSync(new URL(`../../.github/workflows/${name}.yml`, import.meta.url), 'utf8'))
+const workflow = readWorkflow('ci-cache-warmup')
+const steps = workflow.jobs.warm.steps
+
+it('warms the same Linux Node runtime the PR shards restore', () => {
+  const install = steps.find((step) => step.uses === './.github/actions/install-node-dependencies')
+  const primer = readWorkflow('pr').jobs.test_native_cache
+  expect(workflow.jobs.warm['runs-on']).toBe(primer['runs-on'])
+  expect(install.with).toEqual(primer.steps.find((step) => step.uses === install.uses).with)
+})
+
+it('publishes incremental state under a key and prefix that new PRs restore', () => {
+  const cache = steps.find((step) => step.id === 'typecheck-cache')
+  const prCache = readWorkflow('pr').jobs.typecheck.steps.find((step) => step.name === cache.name)
+  expect(cache.with.path).toBe(prCache.with.path)
+  expect(cache.with['restore-keys']).toBe(prCache.with['restore-keys'])
+  expect(cache.with.key).toBe(
+    prCache.with.key.replace('github.event.pull_request.base.sha', 'github.sha')
+  )
+  const check = steps.find((step) => step.run === 'pnpm run typecheck')
+  expect(check.if).toBe("steps.typecheck-cache.outputs.cache-hit != 'true'")
+  expect(steps.indexOf(check)).toBeGreaterThan(steps.indexOf(cache))
+})
+
+it('bounds warming to one hosted job and validates changes without granting writes', () => {
+  expect(Object.keys(workflow.jobs)).toEqual(['warm'])
+  expect(workflow.jobs.warm['timeout-minutes']).toBeLessThanOrEqual(10)
+  expect(workflow.permissions).toEqual({ contents: 'read' })
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.on.schedule).toEqual([{ cron: '41 * * * *' }])
+  expect(workflow.on.pull_request.paths).toContain('.github/workflows/ci-cache-warmup.yml')
+  expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+  expect(workflow.concurrency.group).toContain('github.event.pull_request.number || github.ref')
+  expect(steps[0].with['persist-credentials']).toBe(false)
+})
diff --git a/config/scripts/ci-shard-timings.md b/config/scripts/ci-shard-timings.md
index f6e846cfd6d..78cb3e48835 100644
--- a/config/scripts/ci-shard-timings.md
+++ b/config/scripts/ci-shard-timings.md
@@ -53,13 +53,35 @@ E2E also retains both discovery reports and `selected.txt`. Artifacts live for
 14 days. A rerun of the same source uses the same checked-in baseline rather than
 mutable timing caches; a GitHub job rerun therefore keeps its assignment.
 
+Unit artifacts also contain `unit-timings.json`, measured through Vitest's reporter
+API. Each file's weight includes environment startup, test harness preparation,
+setup files, imports and test execution. Imports are often more expensive than the
+assertions: run **36212793136**, shard 4, spent **535 worker-seconds importing**
+and **357 running tests**. This evidence replaces the old uniform import allowance
+when the next complete successful run is imported.
+
 For E2E reproduction, check out the recorded source and pass the saved list to the
 existing command: `pnpm run test:e2e --test-list=/path/to/selected.txt` with the same
 CI environment/build inputs. For unit reproduction, use the unchanged workflow
 command and exclusions with `ORCA_BALANCE_UNIT_SHARDS=1` and the recorded
 `--shard=INDEX/8`. Direct test-file reruns remain supported.
 
-To refresh the baseline, download `log-JOB_ID.txt` files into one directory from
+To refresh unit weights, download all `unit-shard-node-*` artifacts from one
+successful run attempt and Node version into a directory, preserving their shard
+subdirectories, then run:
+
+```sh
+node config/scripts/ci-unit-timing-import.mjs ARTIFACT_DIRECTORY config/scripts/ci-shard-timings.json
+```
+
+The importer rejects missing or duplicate shards, duplicate files, failed runs,
+unhandled errors and mixed source revisions, run attempts or Node versions. It
+preserves E2E weights and sets unit overhead to zero because the per-file measurements
+already include it. Timing artifacts remain diagnostic; failed or interrupted runs
+are retained for investigation but cannot replace the scheduling baseline.
+
+For older unit runs without reporter artifacts, and E2E refreshes, download
+`log-JOB_ID.txt` files into one directory from
 exactly one eight-shard unit run and one fourteen-shard general E2E run. Use the
 job IDs from the Actions jobs API and fetch each with
 `gh api repos/stablyai/orca/actions/jobs/JOB_ID/logs`. Do not include dedicated
diff --git a/config/scripts/ci-unit-timing-import.mjs b/config/scripts/ci-unit-timing-import.mjs
new file mode 100644
index 00000000000..50a64981670
--- /dev/null
+++ b/config/scripts/ci-unit-timing-import.mjs
@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { compareIds } from './ci-shard-assignment.mjs'
+
+export function importUnitTimingReports(reports) {
+  const first = reports[0]
+  if (!first || first.shard.count !== reports.length) {
+    throw new Error('Expected exactly one complete unit shard set')
+  }
+  const provenance = (report) =>
+    JSON.stringify([
+      report.sourceSha,
+      report.runId,
+      report.runAttempt,
+      report.nodeVersion,
+      report.shard.count
+    ])
+  const indices = new Set()
+  const timings = {}
+  for (const report of reports) {
+    if (
+      report.metric !== 'module-duration-v1' ||
+      report.status !== 'passed' ||
+      report.unhandledErrors !== 0 ||
+      !report.sourceSha ||
+      provenance(report) !== provenance(first)
+    ) {
+      throw new Error('Unit timing reports must come from one successful source/run/Node version')
+    }
+    const { index, count } = report.shard
+    if (!Number.isInteger(index) || index < 1 || index > count || indices.has(index)) {
+      throw new Error('Duplicate or invalid unit shard index')
+    }
+    indices.add(index)
+    for (const [file, duration] of Object.entries(report.timings)) {
+      if (file in timings || !Number.isFinite(duration) || duration <= 0) {
+        throw new Error(`Duplicate or invalid unit timing: ${file}`)
+      }
+      timings[file] = duration
+    }
+  }
+  if (!Object.keys(timings).length) {
+    throw new Error('No unit timing evidence')
+  }
+  return {
+    runId: first.runId,
+    runAttempt: first.runAttempt,
+    sourceSha: first.sourceSha,
+    nodeVersion: first.nodeVersion,
+    metric: first.metric,
+    // Per-module measurements already include setup, imports and environment startup.
+    overheadMs: 0,
+    timings: Object.fromEntries(Object.entries(timings).sort(([a], [b]) => compareIds(a, b)))
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [directory, output] = process.argv.slice(2)
+  if (!directory || !output) {
+    throw new Error('Usage: ci-unit-timing-import.mjs ARTIFACT_DIRECTORY BASELINE_JSON')
+  }
+  const reports = readdirSync(directory, { recursive: true })
+    .filter((file) => file.endsWith('unit-timings.json'))
+    .map((file) => JSON.parse(readFileSync(join(directory, file), 'utf8')))
+  const baseline = JSON.parse(readFileSync(output, 'utf8'))
+  baseline.unit = importUnitTimingReports(reports)
+  writeFileSync(output, `${JSON.stringify(baseline, null, 2)}\n`)
+}
diff --git a/config/scripts/ci-unit-timing-reporter.mjs b/config/scripts/ci-unit-timing-reporter.mjs
new file mode 100644
index 00000000000..58ccc8de768
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.mjs
@@ -0,0 +1,37 @@
+import { relative } from 'node:path'
+import { writeAssignment } from './ci-shard-assignment.mjs'
+
+export function moduleDuration(diagnostic) {
+  return Math.max(
+    1,
+    Math.ceil(
+      diagnostic.environmentSetupDuration +
+        diagnostic.prepareDuration +
+        diagnostic.collectDuration +
+        diagnostic.setupDuration +
+        diagnostic.duration
+    )
+  )
+}
+
+export default class UnitTimingReporter {
+  onInit(ctx) {
+    this.ctx = ctx
+  }
+
+  onTestRunEnd(modules, errors, reason) {
+    writeAssignment(process.env.ORCA_UNIT_TIMING_REPORT ?? 'ci-shards/unit-timings.json', {
+      metric: 'module-duration-v1',
+      nodeVersion: process.versions.node,
+      shard: this.ctx.config.shard ?? { index: 1, count: 1 },
+      status: reason,
+      unhandledErrors: errors.length,
+      timings: Object.fromEntries(
+        modules.map((module) => [
+          relative(this.ctx.config.root, module.moduleId).replaceAll('\\', '/'),
+          moduleDuration(module.diagnostic())
+        ])
+      )
+    })
+  }
+}
diff --git a/config/scripts/ci-unit-timing-reporter.test.mjs b/config/scripts/ci-unit-timing-reporter.test.mjs
new file mode 100644
index 00000000000..5523b494371
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.test.mjs
@@ -0,0 +1,104 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { importUnitTimingReports } from './ci-unit-timing-import.mjs'
+import UnitTimingReporter, { moduleDuration } from './ci-unit-timing-reporter.mjs'
+
+const report = (index, timings) => ({
+  metric: 'module-duration-v1',
+  nodeVersion: '24.21.0',
+  sourceSha: 'source',
+  runId: 'run',
+  runAttempt: '1',
+  shard: { index, count: 2 },
+  status: 'passed',
+  unhandledErrors: 0,
+  timings
+})
+
+describe('unit worker timing evidence', () => {
+  it('counts each worker phase once, including imports of tests with cheap assertions', () => {
+    expect(
+      moduleDuration({
+        environmentSetupDuration: 11,
+        prepareDuration: 12,
+        collectDuration: 130,
+        setupDuration: 14,
+        duration: 0.2,
+        importDurations: { dependency: 100 }
+      })
+    ).toBe(168)
+  })
+
+  it('writes a real reporter result with source and shard provenance', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-unit-timing-'))
+    const previous = process.env.ORCA_UNIT_TIMING_REPORT
+    process.env.ORCA_UNIT_TIMING_REPORT = join(directory, 'unit-timings.json')
+    try {
+      const reporter = new UnitTimingReporter()
+      reporter.onInit({ config: { root: process.cwd(), shard: { index: 1, count: 8 } } })
+      reporter.onTestRunEnd(
+        [
+          {
+            moduleId: resolve('src/example.test.ts'),
+            diagnostic: () => ({
+              environmentSetupDuration: 0,
+              prepareDuration: 0,
+              collectDuration: 200,
+              setupDuration: 10,
+              duration: 5
+            })
+          }
+        ],
+        [],
+        'passed'
+      )
+      expect(JSON.parse(readFileSync(process.env.ORCA_UNIT_TIMING_REPORT, 'utf8'))).toMatchObject({
+        metric: 'module-duration-v1',
+        shard: { index: 1, count: 8 },
+        status: 'passed',
+        unhandledErrors: 0,
+        timings: { 'src/example.test.ts': 215 }
+      })
+    } finally {
+      if (previous === undefined) {
+        delete process.env.ORCA_UNIT_TIMING_REPORT
+      } else {
+        process.env.ORCA_UNIT_TIMING_REPORT = previous
+      }
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('imports all shards without adding the old average overhead again', () => {
+    expect(importUnitTimingReports([report(2, { b: 100 }), report(1, { a: 200 })])).toMatchObject({
+      sourceSha: 'source',
+      overheadMs: 0,
+      metric: 'module-duration-v1',
+      timings: { a: 200, b: 100 }
+    })
+  })
+
+  it('rejects incomplete, duplicate, mixed and failed evidence', () => {
+    const first = report(1, { a: 100 })
+    expect(() => importUnitTimingReports([first])).toThrow('complete')
+    expect(() => importUnitTimingReports([first, first])).toThrow('index')
+    expect(() => importUnitTimingReports([first, report(2, { a: 200 })])).toThrow('timing')
+    for (const change of [
+      { sourceSha: 'other' },
+      { runId: 'other' },
+      { runAttempt: '2' },
+      { nodeVersion: '26.6.0' },
+      { metric: 'test-duration' },
+      { status: 'failed' },
+      { status: 'interrupted' },
+      { unhandledErrors: 1 }
+    ]) {
+      expect(() =>
+        importUnitTimingReports([first, { ...report(2, { b: 200 }), ...change }])
+      ).toThrow('successful')
+    }
+    expect(() => importUnitTimingReports([first, report(2, { b: -1 })])).toThrow('timing')
+  })
+})
diff --git a/config/scripts/cloud-security-history-workflow.test.mjs b/config/scripts/cloud-security-history-workflow.test.mjs
new file mode 100644
index 00000000000..5c91ac95028
--- /dev/null
+++ b/config/scripts/cloud-security-history-workflow.test.mjs
@@ -0,0 +1,90 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/cloud-verify.yml', import.meta.url), 'utf8')
+)
+const steps = workflow.jobs.security.steps
+const history = steps.find((step) => step.name === 'Fetch complete scan history')
+
+it('fetches both merge parents and deleted content without unrelated branches or tags', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-cloud-history-'))
+  const source = join(directory, 'source')
+  const checkout = join(directory, 'checkout')
+  const run = (program, args, cwd, env = process.env) => {
+    const result = runProcessSync({ program, args, cwd, env })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  const git = (args, cwd = source) => run('git', args, cwd)
+  const commit = (message) => {
+    git(['add', '-A'])
+    git(['-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', message])
+    return git(['rev-parse', 'HEAD'])
+  }
+
+  try {
+    run('git', ['init', '--quiet', source], directory)
+    git(['checkout', '-b', 'main'])
+    git(['config', 'user.name', 'CI test'])
+    git(['config', 'user.email', 'ci@example.invalid'])
+    mkdirSync(join(source, 'cloud'))
+    writeFileSync(join(source, 'cloud', 'removed.txt'), 'historical-scan-marker\n')
+    const original = commit('historical content')
+    rmSync(join(source, 'cloud', 'removed.txt'))
+    writeFileSync(join(source, 'cloud', 'current.txt'), 'current\n')
+    commit('delete historical content')
+    git(['checkout', '-b', 'feature'])
+    writeFileSync(join(source, 'cloud', 'feature.txt'), 'feature-parent-marker\n')
+    commit('feature parent')
+    git(['checkout', 'main'])
+    writeFileSync(join(source, 'cloud', 'base.txt'), 'base-parent-marker\n')
+    commit('base parent')
+    git(['-c', 'commit.gpgsign=false', 'merge', '--no-ff', 'feature', '-m', 'PR merge'])
+    const sha = git(['rev-parse', 'HEAD'])
+    const expectedHistory = git(['rev-list', 'HEAD']).split('\n').sort()
+    const expectedPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'])
+    git(['checkout', '-b', 'unrelated', original])
+    writeFileSync(join(source, 'unrelated.txt'), 'unrelated-object\n')
+    const unrelated = commit('unrelated branch')
+    git(['tag', 'unrelated-tag'])
+    git(['checkout', 'main'])
+
+    run(
+      'git',
+      ['clone', '--depth=1', '--no-tags', '--branch', 'main', pathToFileURL(source).href, checkout],
+      directory
+    )
+    expect(git(['rev-list', '--count', 'HEAD'], checkout)).toBe('1')
+    run('bash', ['-e', '-c', history.run], checkout, { ...process.env, GITHUB_SHA: sha })
+
+    expect(git(['rev-list', 'HEAD'], checkout).split('\n').sort()).toEqual(expectedHistory)
+    const actualPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'], checkout)
+    expect(actualPatch).toBe(expectedPatch)
+    expect(actualPatch).toContain('historical-scan-marker')
+    expect(actualPatch).toContain('feature-parent-marker')
+    expect(actualPatch).toContain('base-parent-marker')
+    expect(git(['tag', '--list'], checkout)).toBe('')
+    expect(
+      runProcessSync({ program: 'git', args: ['cat-file', '-e', unrelated], cwd: checkout }).code
+    ).not.toBe(0)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+it('completes history before scanning the same HEAD and Cloud paths', () => {
+  expect(steps[0].with['fetch-depth']).toBe(1)
+  expect(history['working-directory']).toBe('.')
+  const scanIndex = steps.findIndex((step) => step.run?.includes('gitleaks@'))
+  expect(steps.indexOf(history)).toBeLessThan(scanIndex)
+  expect(steps[scanIndex].run).toContain(
+    '--log-opts="HEAD -- cloud :(glob).github/workflows/cloud-*.yml .github/actions/cloud-sql-rollout-lease"'
+  )
+  expect(steps.some((step) => step.run?.includes('trufflehog@'))).toBe(true)
+})
diff --git a/config/scripts/git-binary-compatibility-workflow.test.mjs b/config/scripts/git-binary-compatibility-workflow.test.mjs
index 35d2b5c60dc..c03c7973f6a 100644
--- a/config/scripts/git-binary-compatibility-workflow.test.mjs
+++ b/config/scripts/git-binary-compatibility-workflow.test.mjs
@@ -3,6 +3,8 @@ import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
 
 const BASELINE_DIR = '~/.cache/orca-git-compat/git-2.25.5'
+const BASELINE_ACTION = './.github/actions/prepare-git-compatibility'
+const baselineSteps = parse(readFileSync(`${BASELINE_ACTION}/action.yml`, 'utf8')).runs.steps
 
 const gateSteps = () =>
   parse(readFileSync('.github/workflows/pr.yml', 'utf8')).jobs.git_compatibility.steps
@@ -23,7 +25,7 @@ describe('Git binary compatibility PR gate', () => {
   })
 
   it('builds the pinned baseline tarball into the cached directory', () => {
-    const run = stepNamed('Build the baseline Git binary')?.run
+    const run = baselineSteps.find((step) => step.name === 'Build the baseline Git binary')?.run
 
     expect(run).toContain('git-2.25.5.tar.gz')
     // Why asserted: the sha256 check only runs on the build path, so a cached binary
@@ -31,6 +33,9 @@ describe('Git binary compatibility PR gate', () => {
     expect(run).toContain('if [ -x "$source/git" ]; then')
     expect(run).toContain('41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf')
     expect(run).toContain('-j"$(nproc)"')
+    expect(run).toContain('NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git')
+    expect(run).toContain('sha256sum --check')
+    expect(run).toContain('find "$source" -name \'*.o\' -delete')
     // The cached path and the build path must be the same directory or the guard
     // above would rebuild on every run while still reporting a cache hit.
     expect(run).toContain('source="$HOME/.cache/orca-git-compat/git-2.25.5"')
@@ -38,20 +43,33 @@ describe('Git binary compatibility PR gate', () => {
 
   it('finishes the baseline build before the timed lanes start', () => {
     const steps = gateSteps()
-    const names = steps.map((step) => step.name)
+    const names = baselineSteps.map((step) => step.name)
     const cacheIndex = names.indexOf('Cache baseline Git build')
     const buildIndex = names.indexOf('Build the baseline Git binary')
-    const matrixIndex = names.indexOf('Verify Git binary compatibility matrix')
+    const prepareIndex = steps.findIndex((step) => step.uses === BASELINE_ACTION)
+    const matrixIndex = steps.findIndex(
+      (step) => step.name === 'Verify Git binary compatibility matrix'
+    )
 
     expect(cacheIndex).toBeGreaterThanOrEqual(0)
     expect(cacheIndex).toBeLessThan(buildIndex)
-    expect(buildIndex).toBeLessThan(matrixIndex)
+    expect(prepareIndex).toBeGreaterThanOrEqual(0)
+    expect(prepareIndex).toBeLessThan(matrixIndex)
     // Why asserted: each lane is bounded by Vitest's per-test timeout while it waits on
     // container starts, so a `make -j$(nproc)` sharing the runner shows up as a timeout
     // in whichever boundary case is running rather than as a slow build.
     expect(steps[matrixIndex].run).not.toContain('make -C')
-    expect(steps[cacheIndex].with.path).toBe(BASELINE_DIR)
-    expect(steps[cacheIndex].with.key).toContain('2.25.5')
+    expect(baselineSteps[cacheIndex].with.path).toBe(BASELINE_DIR)
+    expect(baselineSteps[cacheIndex].with.key).toBe(
+      'git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5'
+    )
+  })
+
+  it('warms the same baseline on main so newly opened PRs can restore it', () => {
+    const warmer = parse(readFileSync('.github/workflows/ci-cache-warmup.yml', 'utf8'))
+    expect(warmer.jobs.warm.steps.some((step) => step.uses === BASELINE_ACTION)).toBe(true)
+    expect(warmer.on.push.paths).toContain('.github/actions/prepare-git-compatibility/**')
+    expect(warmer.on.pull_request.paths).toContain('.github/actions/prepare-git-compatibility/**')
   })
 
   it('pulls every matrix image before any lane runs', () => {
diff --git a/config/scripts/mobile-web-app-haptics-seam.test.mjs b/config/scripts/mobile-web-app-haptics-seam.test.mjs
index 96c02c4b29b..6f9c6c1afcf 100644
--- a/config/scripts/mobile-web-app-haptics-seam.test.mjs
+++ b/config/scripts/mobile-web-app-haptics-seam.test.mjs
@@ -40,6 +40,14 @@ const read = (file) => readFileSync(join(mobileDir, file), 'utf8')
 /** The route module behind each declared page route, shared with the screencast-lane census. */
 const ROUTE_MODULES = PAGE_ROUTE_MODULES
 
+// These cases read the same source tree; keep each route's real closure once.
+const closures = new Map()
+async function closureOf(module) {
+  const built = closures.get(module) ?? mobileWebAppRouteClosure(module)
+  closures.set(module, built)
+  return structuredClone(await built)
+}
+
 const HAPTICS_GRANT = 'haptics'
 
 /** The shell's mapping from a notify kind to one of the app's own functions. */
@@ -222,7 +230,7 @@ describeClosure(
   'every page route closure and the haptics seam',
   () => {
     it.each([...ROUTE_MODULES])('resolves the seam to the web sibling: %s', async (_route, mod) => {
-      const closure = await mobileWebAppRouteClosure(mod)
+      const closure = await closureOf(mod)
       expect(closure.local).toContain(HAPTICS_SEAM)
       expect(closure.local).not.toContain(HAPTICS_NATIVE)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
@@ -232,7 +240,7 @@ describeClosure(
     it.each([...ROUTE_MODULES])(
       'imports the seam from at least one module, so the grant is not idle: %s',
       async (_route, mod) => {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(hapticsSeamImporters(mobileDir, closure).length).toBeGreaterThan(0)
       }
     )
@@ -252,7 +260,7 @@ describeClosure(
     it('declares haptics on exactly the routes whose closure reaches the seam', async () => {
       const reaching = []
       for (const [route, mod] of ROUTE_MODULES) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         if (hapticsSeamImporters(mobileDir, closure).length > 0) {
           reaching.push(route)
         }
@@ -283,7 +291,7 @@ describeClosure(
      */
     it('adds one module to a page closure, and only the two haptics modules are in it', async () => {
       for (const mod of ROUTE_MODULES.values()) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(closure.local.filter((file) => file.includes('haptics')).sort(), mod).toEqual([
           HAPTICS_KINDS_MODULE,
           HAPTICS_SEAM
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
index af41a468363..04e6ffcf6e5 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
@@ -84,6 +84,28 @@ function parse(source, fileName) {
   )
 }
 
+function grantReferences(source, fileName) {
+  const calls = new Set()
+  const imports = new Set()
+  const walk = (node) => {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+      calls.add(node.expression.text)
+    }
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.add(node.moduleSpecifier.text)
+    }
+    ts.forEachChild(node, walk)
+  }
+  walk(parse(source, fileName))
+  return { calls, imports }
+}
+
+function referencesReachRow(references, row) {
+  return row.kind === 'call'
+    ? references.calls.has(row.callee)
+    : row.kind === 'import' && references.imports.has(row.specifier)
+}
+
 /**
  * Whether this module reaches the row's seam: calls the function, or imports the substituted module.
  *
@@ -92,44 +114,36 @@ function parse(source, fileName) {
  * can never ask for it, which is the failure a hand-written list already had.
  */
 export function moduleReachesGrantRow(source, fileName, row) {
-  let reached = false
-  const walk = (node) => {
-    if (
-      row.kind === 'call' &&
-      ts.isCallExpression(node) &&
-      ts.isIdentifier(node.expression) &&
-      node.expression.text === row.callee
-    ) {
-      reached = true
+  return referencesReachRow(grantReferences(source, fileName), row)
+}
+
+// One source version per file, scoped to a census; edits invalidate the parsed references.
+export function createGrantCallSiteReader() {
+  const files = new Map()
+  return (source, fileName, row) => {
+    let held = files.get(fileName)
+    if (held?.source !== source) {
+      held = { source, references: grantReferences(source, fileName) }
+      files.set(fileName, held)
     }
-    if (
-      row.kind === 'import' &&
-      ts.isImportDeclaration(node) &&
-      ts.isStringLiteral(node.moduleSpecifier) &&
-      node.moduleSpecifier.text === row.specifier
-    ) {
-      reached = true
-    }
-    ts.forEachChild(node, walk)
+    return referencesReachRow(held.references, row)
   }
-  walk(parse(source, fileName))
-  return reached
 }
 
 /** Every module in the closure that reaches the row, the seam itself never counting as its own use. */
-export function grantCallSites(mobileDir, closure, row) {
+export function grantCallSites(mobileDir, closure, row, readModule = moduleReachesGrantRow) {
   return closure.local.filter((file) => {
     if (!/\.tsx?$/.test(file) || file === row.seam) {
       return false
     }
-    return moduleReachesGrantRow(readFileSync(join(mobileDir, file), 'utf8'), file, row)
+    return readModule(readFileSync(join(mobileDir, file), 'utf8'), file, row)
   })
 }
 
 /** Every grant this closure's own call sites need, in row order. */
-export function grantsNeeded(mobileDir, closure) {
+export function grantsNeeded(mobileDir, closure, readModule) {
   return PAGE_GRANT_CALL_SITES.filter(
-    (row) => grantCallSites(mobileDir, closure, row).length > 0
+    (row) => grantCallSites(mobileDir, closure, row, readModule).length > 0
   ).flatMap((row) => row.grants)
 }
 
@@ -141,11 +155,11 @@ export function grantsNeeded(mobileDir, closure) {
  * grant. A single whole-manifest check would red under every row at once and say only that
  * something was missing.
  */
-export async function grantsMissingForRow(mobileDir, routes, closureOf, row) {
+export async function grantsMissingForRow(mobileDir, routes, closureOf, row, readModule) {
   const missing = []
   for (const route of routes) {
     const closure = await closureOf(route.pathname)
-    if (grantCallSites(mobileDir, closure, row).length === 0) {
+    if (grantCallSites(mobileDir, closure, row, readModule).length === 0) {
       continue
     }
     for (const grant of row.grants) {
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
index cbcf86956c7..e70c7d49aad 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
@@ -6,7 +6,8 @@
  * reddened nothing. Each row below gets its own named case, and each case's control is the same
  * rule driven over the entry that route would have had with the grant struck out.
  */
-import { readFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
@@ -20,6 +21,7 @@ import { MOBILE_WEB_PAGE_ROUTES } from './mobile-web-page-routes.mjs'
 import { spelledCountsAgainstTables } from './spelled-count-census.mjs'
 import {
   PAGE_GRANT_CALL_SITES,
+  createGrantCallSiteReader,
   grantCallSites,
   grantsMissingForRow,
   grantsNeeded,
@@ -33,6 +35,7 @@ const SESSION = '/h/[hostId]/session/[worktreeId]'
 
 /** Memoised: every case below walks all eight, and a closure is a bundle the walk builds. */
 const closures = new Map()
+const readGrantModule = createGrantCallSiteReader()
 
 function closureOf(pathname) {
   const mod = PAGE_ROUTE_MODULES.get(pathname)
@@ -120,6 +123,27 @@ describe('the call-site reader', () => {
     }
   })
 
+  it('reuses parsed references across rows while observing source and row changes', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-grant-reader-'))
+    const file = join(directory, 'route.tsx')
+    const readModule = createGrantCallSiteReader()
+    const closure = { local: ['route.tsx'] }
+    const source = 'export const view = <View />; useRouteHandoff()'
+    try {
+      await writeFile(file, source)
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual([])
+      expect(readModule(source, 'route.tsx', { ...navigate, callee: 'absent' })).toBe(false)
+      await writeFile(file, 'export const view = <View />; // useRouteHandoff()')
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+      await writeFile(file, "import storage from '@react-native-async-storage/async-storage'")
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
   it('counts a call and not an import that never calls it', () => {
     expect(
       moduleReachesGrantRow(
@@ -213,7 +237,13 @@ describeClosure(
       'declares %s on every registered route whose own call sites reach it',
       async (_name, row) => {
         expect(
-          await grantsMissingForRow(mobileDir, MOBILE_WEB_PAGE_ROUTES, closureOf, row)
+          await grantsMissingForRow(
+            mobileDir,
+            MOBILE_WEB_PAGE_ROUTES,
+            closureOf,
+            row,
+            readGrantModule
+          )
         ).toEqual([])
       }
     )
@@ -229,17 +259,19 @@ describeClosure(
     it.each(PAGE_GRANT_CALL_SITES.map((row) => [row.grants.join(' + '), row]))(
       'reds the session route when it is registered without %s',
       async (_name, row) => {
-        const needed = grantsNeeded(mobileDir, await closureOf(SESSION))
+        const needed = grantsNeeded(mobileDir, await closureOf(SESSION), readGrantModule)
         expect(needed, 'the session route reaches this row').toEqual(
           expect.arrayContaining(row.grants)
         )
         const entry = (grants) => [{ pathname: SESSION, grants }]
         // Declaring everything it reaches passes, so each case is a rule and not a wall.
-        expect(await grantsMissingForRow(mobileDir, entry(needed), closureOf, row)).toEqual([])
+        expect(
+          await grantsMissingForRow(mobileDir, entry(needed), closureOf, row, readGrantModule)
+        ).toEqual([])
         const without = needed.filter((grant) => !row.grants.includes(grant))
-        expect(await grantsMissingForRow(mobileDir, entry(without), closureOf, row)).toEqual(
-          row.grants.map((grant) => `${SESSION} needs ${grant}`)
-        )
+        expect(
+          await grantsMissingForRow(mobileDir, entry(without), closureOf, row, readGrantModule)
+        ).toEqual(row.grants.map((grant) => `${SESSION} needs ${grant}`))
       }
     )
 
@@ -247,12 +279,12 @@ describeClosure(
       const closure = await closureOf(SESSION)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
       expect(closure.local.length).toBeGreaterThan(250)
-      expect(grantsNeeded(mobileDir, closure)).toEqual(
+      expect(grantsNeeded(mobileDir, closure, readGrantModule)).toEqual(
         PAGE_GRANT_CALL_SITES.flatMap((row) => row.grants)
       )
       for (const row of PAGE_GRANT_CALL_SITES) {
         expect(
-          grantCallSites(mobileDir, closure, row).length,
+          grantCallSites(mobileDir, closure, row, readGrantModule).length,
           row.grants.join(' + ')
         ).toBeGreaterThan(0)
       }
@@ -264,10 +296,10 @@ describeClosure(
       const reaching = { reader: [], media: [] }
       for (const pathname of PAGE_ROUTE_MODULES.keys()) {
         const closure = await closureOf(pathname)
-        if (grantCallSites(mobileDir, closure, readerRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, readerRow, readGrantModule).length > 0) {
           reaching.reader.push(pathname)
         }
-        if (grantCallSites(mobileDir, closure, mediaRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, mediaRow, readGrantModule).length > 0) {
           reaching.media.push(pathname)
         }
       }
diff --git a/config/scripts/pr-code-change-scope.mjs b/config/scripts/pr-code-change-scope.mjs
index f984ff56590..c5a52e262e7 100644
--- a/config/scripts/pr-code-change-scope.mjs
+++ b/config/scripts/pr-code-change-scope.mjs
@@ -44,6 +44,7 @@ const GLOBAL_FORCE_PREFIXES = [
 const GLOBAL_FORCE_FILES = new Set(['package.json', 'pnpm-lock.yaml'])
 
 const GIT_COMPAT_PREFIXES = [
+  '.github/actions/prepare-git-compatibility/',
   'src/shared/git-',
   'src/shared/review-head-tracking-ref',
   'src/main/git/',
diff --git a/config/scripts/pr-code-change-scope.test.mjs b/config/scripts/pr-code-change-scope.test.mjs
index cab82db3e03..5bbcbeb5c06 100644
--- a/config/scripts/pr-code-change-scope.test.mjs
+++ b/config/scripts/pr-code-change-scope.test.mjs
@@ -129,6 +129,9 @@ describe('per-job path classification', () => {
     expectClassification(['src/shared/git-binary-compatibility.test.ts'], {
       git_compatibility: true
     })
+    expectClassification(['.github/actions/prepare-git-compatibility/action.yml'], {
+      git_compatibility: true
+    })
   })
 
   it('runs the Codex index-heal contract only when the heal or its transport changes', () => {
@@ -546,9 +549,16 @@ describe('PR Checks skip wiring', () => {
     expect(installStep.run).toContain('--frozen-lockfile')
   })
 
-  it('keeps the cheap root-directory guard on docs-only PRs', () => {
-    expect(prWorkflow.jobs.root_directory_guard.if).toBeUndefined()
-    expect(prWorkflow.jobs.root_directory_guard.needs).toBeUndefined()
+  it('keeps the root and README guards on docs-only PRs without another runner', () => {
+    const detector = prWorkflow.jobs.code_paths
+    expect(detector.if).toBeUndefined()
+    expect(detector.needs).toBeUndefined()
+    for (const name of ['Reject new root-level files and folders', 'Check README local links']) {
+      const step = detector.steps.find((candidate) => candidate.name === name)
+      expect(step).toBeDefined()
+      expect(step.if).toBeUndefined()
+    }
+    expect(prWorkflow.jobs.root_directory_guard).toBeUndefined()
   })
 
   it('gates each expensive job on its classifier and cache prerequisite', () => {
@@ -587,12 +597,12 @@ describe('PR Checks skip wiring', () => {
     )
     expect(prWorkflow.jobs.verify.needs[0]).toBe('code_paths')
     expect(verifyStep.env.SHOULD_RUN).toBe('${{ needs.code_paths.outputs.should_run }}')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
+    expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
     expect(verifyStep.run).toContain('# Require success when the PR has code-relevant changes')
     expect(verifyStep.run).toContain('expected skipped')
     expect(verifyStep.run).toContain('expected success')
     for (const job of prWorkflow.jobs.verify.needs) {
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       const envVar = `${job.replaceAll('-', '_').toUpperCase()}_SHOULD_RUN`
diff --git a/config/scripts/pr-e2e-gate-contract.test.mjs b/config/scripts/pr-e2e-gate-contract.test.mjs
index d586f27ff1a..518cf62b930 100644
--- a/config/scripts/pr-e2e-gate-contract.test.mjs
+++ b/config/scripts/pr-e2e-gate-contract.test.mjs
@@ -127,11 +127,10 @@ describe('PR E2E gate contract', () => {
     const successLoop = verifyStep.run.slice(verifyStep.run.indexOf(successMarker))
     expect(successLoop.length).toBeGreaterThan(0)
     expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
     for (const job of prWorkflow.jobs.verify.needs) {
       const envVar = job.replaceAll('-', '_').toUpperCase()
       expect(verifyStep.env[envVar]).toBe(`\${{ needs.${job}.result }}`)
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       expect(successLoop).toContain(`"$${envVar}"`)
diff --git a/config/scripts/pr-test-loc-summary.test.mjs b/config/scripts/pr-test-loc-summary.test.mjs
index 044b645a29c..d206c3c09a0 100644
--- a/config/scripts/pr-test-loc-summary.test.mjs
+++ b/config/scripts/pr-test-loc-summary.test.mjs
@@ -233,7 +233,7 @@ describe('PR test LoC summary', () => {
   })
 
   it('is a no-checkout GitHub-hosted PR workflow', () => {
-    expect(locJob['runs-on']).toBe('ubuntu-latest')
+    expect(locJob['runs-on']).toBe('ubuntu-slim')
     expect(locJob.steps).toHaveLength(1)
     expect(locStep.run).toContain('gh api')
     expect(locStep.run).toContain('pr-test-loc-table.mjs')
diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs
index 0ed60ffb4bb..ffe5141bce0 100644
--- a/config/scripts/pr-workflow-parallelism.test.mjs
+++ b/config/scripts/pr-workflow-parallelism.test.mjs
@@ -4,6 +4,10 @@ import { describe, expect, it } from 'vitest'
 import { MOBILE_WEB_APP_DEPENDENCIES_REQUIRED_ENV } from './mobile-web-app-bundle-dependencies.mjs'
 
 const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const prTestLocWorkflow = parse(readFileSync('.github/workflows/pr-test-loc.yml', 'utf8'))
+const trackingWorkflow = parse(readFileSync('.github/workflows/track-community-prs.yaml', 'utf8'))
+const releasePolicyWorkflow = parse(readFileSync('.github/workflows/release-policy.yml', 'utf8'))
+const issueLabelWorkflow = parse(readFileSync('.github/workflows/issue-os-labeler.yaml', 'utf8'))
 const unitTestWorkflow = parse(readFileSync('.github/workflows/unit-tests.yml', 'utf8'))
 const nodeNextWorkflow = parse(readFileSync('.github/workflows/node-next-compat.yml', 'utf8'))
 const dependencyAction = parse(
@@ -43,9 +47,22 @@ const realZshUsage =
   /(?:spawnSync|execFileSync|spawn)\(\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|spawnSync\(\s*['"]which['"]\s*,\s*\[\s*['"]zsh['"]|name:\s*['"]zsh['"]\s*,\s*path:\s*executablePath|from '[^']*zsh-startup-hook-pty-harness'/
 
 describe('PR workflow parallelism', () => {
+  it('keeps lightweight orchestration jobs on the free slim runner', () => {
+    expect(workflow.jobs.code_paths['runs-on']).toBe('ubuntu-slim')
+    expect(workflow.jobs.typecheck['runs-on']).toBe('ubuntu-24.04-arm')
+    expect(workflow.jobs.verify['runs-on']).toBe('ubuntu-slim')
+    expect(prTestLocWorkflow.jobs.loc['runs-on']).toBe('ubuntu-slim')
+    expect(trackingWorkflow.jobs['track-community-pr']['runs-on']).toBe('ubuntu-slim')
+    expect(releasePolicyWorkflow.jobs.enforce['runs-on']).toBe('ubuntu-slim')
+    expect(issueLabelWorkflow.jobs['apply-os-label']['runs-on']).toBe('ubuntu-slim')
+  })
+
   it('cancels superseded runs for the same pull request', () => {
     expect(workflow.concurrency.group).toBe('pr-checks-${{ github.event.pull_request.number }}')
     expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+    expect(workflow.jobs.test.if).toContain('!cancelled()')
+    expect(workflow.jobs.test.if).not.toContain('always()')
+    expect(workflow.jobs.verify.if).toBe('${{ !cancelled() }}')
   })
 
   it('grants the PR workflow read-only repository access', () => {
@@ -456,7 +473,6 @@ describe('PR workflow parallelism', () => {
     expect(workflow.jobs.verify.needs).toEqual([
       'code_paths',
       'static_analysis',
-      'root_directory_guard',
       'typecheck',
       'git_compatibility',
       'codex_index_heal_contract',
diff --git a/config/vitest.config.ts b/config/vitest.config.ts
index beaf82f4e12..6713372ec87 100644
--- a/config/vitest.config.ts
+++ b/config/vitest.config.ts
@@ -17,7 +17,10 @@ export default defineConfig({
   test: {
     environment: 'node',
     ...(process.env.ORCA_BALANCE_UNIT_SHARDS === '1'
-      ? { sequence: { sequencer: TimingSequencer } }
+      ? {
+          sequence: { sequencer: TimingSequencer },
+          reporters: ['default', resolve('config/scripts/ci-unit-timing-reporter.mjs')]
+        }
       : {}),
     // Why: Node 26's undefined Web Storage globals prevent Vitest from installing happy-dom's.
     // Why --expose-gc: retention tests need a deterministic collection point to measure what a queue really holds.
diff --git a/docs/reference/ci-runner-efficiency.md b/docs/reference/ci-runner-efficiency.md
index 6d688598097..86a7d4db654 100644
--- a/docs/reference/ci-runner-efficiency.md
+++ b/docs/reference/ci-runner-efficiency.md
@@ -1,5 +1,131 @@
 # CI efficiency and runner capacity
 
+## September 25 follow-up
+
+The current queue is a bigger part of PR latency than setup. Successful full PR
+[36212793136](https://github.com/stablyai/orca/actions/runs/36212793136) used
+**74.6 aggregate runner-minutes**, including **55.5** for its eight unit shards.
+Those jobs ran for 315–448 seconds but waited 229–1,076 seconds to start. The
+three-second final `verify` job waited another 264 seconds. These are observed
+job creation-to-start and start-to-completion intervals, not billing figures.
+
+This follow-up keeps the existing tests, isolation, eight unit shards, platform
+coverage, and release behavior:
+
+- Make the reusable unit-test call and final aggregate respect cancellation.
+  Their old `always()` conditions kept superseded work alive despite workflow
+  cancellation. In [36215475069](https://github.com/stablyai/orca/actions/runs/36215475069),
+  a newer push cancelled ordinary jobs while all eight unit shards remained
+  queued and the replacement workflow remained pending. `!cancelled()` still
+  evaluates after failed/skipped dependencies, without resisting cancellation.
+  Two other superseded PR runs reproduced this: at 04:27 UTC on September 26,
+  [36216165253](https://github.com/stablyai/orca/actions/runs/36216165253) and
+  [36215543186](https://github.com/stablyai/orca/actions/runs/36215543186) still held
+  11 runners, with two more obsolete jobs queued. They had consumed another
+  71.3 runner-minutes after replacement pushes. After rechecking current PR heads
+  and replacement runs, both obsolete runs were force-cancelled; their replacements
+  left the blocked pending state.
+- Combine root/README guards with change detection. A real sparse checkout kept
+  all 29,487 index entries while materializing only 12 files (192 KB). This
+  eliminates one runner allocation and checkout per PR. README link checks still
+  see tracked targets outside the working tree and run on docs-only PRs.
+- Use free `ubuntu-slim` containers for small guard/aggregate/API jobs; trial
+  free `ubuntu-24.04-arm` for typechecking, which needs no native runtime.
+  Both share the account's standard concurrency limit. Different labels do
+  **not** grant extra concurrent jobs; hosted timings determine their value.
+- Cancel superseded PR attempts in the Git termination, Pi owner, and Pi provider
+  runtime workflows, retaining independent manual runs.
+- Fetch only complete HEAD ancestry for cloud secret scanning. The old checkout
+  fetched every branch and tag and took 55 seconds in
+  [36214130174](https://github.com/stablyai/orca/actions/runs/36214130174).
+  Real Git fixtures prove both merge parents and deleted historical contents
+  still produce the identical scanned patches.
+- Remove the cloud lockfile from the eight unit shards' download-cache key; the
+  dedicated relay integration job still includes it. Record actual per-file
+  environment, setup, import, and test durations for the existing shard planner.
+  Shard 4 spent 535 worker-seconds importing and 357 executing tests; a uniform
+  per-file import estimate misses that cost. See [timing refresh](../../config/scripts/ci-shard-timings.md).
+- Seed Node 24 native modules, the pinned Git compatibility binary, and TypeScript
+  state on the default branch, hourly
+  and when dependency/toolchain inputs change. One ten-minute-bounded hosted job
+  reuses existing cache keys and skips typechecking an already-cached commit.
+  New PRs can restore default-branch caches, while caches saved by another PR
+  are inaccessible. The audit found 80 entries totaling 10.67 GiB, including
+  9.31 GiB of pnpm stores, but no main-branch Node 24 native or TypeScript state.
+  Seven PRs held separate copies of the same pnpm key (2.36 GB combined).
+  Git preparation now has one shared action with the unchanged cache key,
+  checksum, and build command. In
+  [36212101873](https://github.com/stablyai/orca/actions/runs/36212101873), a new PR
+  spent 40 seconds compiling the same Git 2.25.5 binary; main-branch warming
+  makes that cache available to new PRs too.
+
+The hosted trial also removes repeated work in mobile bundle checks. The
+builder keeps private snapshots of the default real output for read-only checks
+(15 identical builds become two), and haptics checks reuse each route closure
+(32 builds become eight). Determinism, custom inputs, malformed routes, stale
+outputs, and tampered manifests retain independent builds. A mutation regression
+proves Buffer/manifest consumers cannot change another assertion's fixture.
+The grant census reuses parsed references for unchanged file contents, still
+reads source every time, and has a real-file edit invalidation regression.
+The first hosted mobile lane used 400 seconds for its 448 tests; the grant
+census alone took 259 seconds. Locally, the same one-worker invocation of the
+three changed files fell from 243.07 seconds (101 passing tests) to 49.49 seconds
+(103 passing tests). Hosted run
+[36217238462](https://github.com/stablyai/orca/actions/runs/36217238462) retained
+the same 43 files and passed all 450 tests: the original 448 plus two regressions.
+Its test step fell from 400.26 to 205.17 seconds, and the complete job fell from
+498 to 298 seconds (40% less runner time). Builder, haptics, and grant-census file
+times fell from 73.70/88.94/258.58 seconds to 29.24/32.98/22.58 seconds.
+The later default-worker verification retained the same 450-test coverage, but
+its unchanged terminal-render test failed twice on the pre-existing timing
+assertion that a frame must be pending at disposal (`expected 0 to be greater
+than 0`). Its other 449 tests passed; no mobile source or assertion was relaxed.
+
+A four-worker experiment reduced aggregate unit job time from 3,386 to 3,133
+seconds (7.5%), but the repeat run exceeded the palette matcher's existing
+180ms performance budget at 235ms. The override was removed; retain Vitest's
+default worker count, isolation, timeouts, retries, and coverage. The first trial
+also found an outdated hook-order snapshot after main added three layout-persistence
+hooks. That snapshot was refreshed only after comparing the exact old and merged
+hook sequences. Final verification is linked from
+[PR #23053](https://github.com/stablyai/orca/pull/23053). Failed timing reports
+never replace the checked-in baseline.
+
+No account settings, paid services, or runner entitlements changed. Standard
+public-repository runners remain free. GitHub documents plan concurrency limits
+of Free 20, Pro 40, Team 60, Enterprise 500, and permits support requests for
+increases. The organization's actual entitlement was not exposed by the API.
+See [runner specifications](https://docs.github.com/en/actions/reference/runners/github-hosted-runners)
+and [concurrency limits](https://docs.github.com/en/actions/reference/limits).
+
+Hosted observations from [PR run 36215718607](https://github.com/stablyai/orca/actions/runs/36215718607):
+
+| Check                                     | Earlier sample |        Trial | Result               |
+| ----------------------------------------- | -------------: | -----------: | -------------------- |
+| Detection plus repository guards          |  54s, two jobs | 26s, one job | Passed               |
+| Typecheck (whole job)                     |       109s x64 |      81s ARM | Passed               |
+| Typecheck command, cold incremental state |        76s x64 |      51s ARM | Passed               |
+| Cloud secret scan (whole job)             |            69s |          55s | Passed               |
+| Cloud checkout/history fetch              |            55s |          40s | Identical scan scope |
+
+The [warmup trial](https://github.com/stablyai/orca/actions/runs/36215718295)
+passed in 54 seconds. Its x64 compiler restored the ARM job's incremental state
+and rechecked the same source in eight seconds. Unit shard 3 subsequently
+restored its pnpm/native cache keys successfully. Actual sharing across different
+PRs requires the producer to land on the default branch; this trial validates
+commands and key compatibility, not a completed default-branch rollout.
+The follow-up warmup built the Git binary in 40 seconds; the PR Git check restored
+that exact key and passed in 62 seconds overall. Its TypeScript refresh took
+seven seconds after restoring earlier incremental state.
+
+These are small observational samples from different revisions, not controlled
+benchmarks. The cold typecheck log confirms an incremental-cache miss. Queue
+changes must be separated from active duration and concurrent account traffic.
+The checked-in shard weights remain unchanged; the new reports make future
+refreshes possible from complete successful runs.
+
+## September 5 audit
+
 Audit date: September 5, 2026. No paid capacity or provider configuration changed.
 
 ## Measurements and changes