fix(source-ledger): keep glob wildcards in register waiver lines, plus a privacy fix that unblocks the leak guard

[MendixMau]

Two commits. The first one is the reason the second one could be committed at all, so please read them in order.

1. privacy: genericize a client project name in three tracked files

bin/check-no-client-data.sh was red on a clean tree, before any change of mine. A client project name was on four lines across CHANGELOG.md, project-bin/wf-set-call-captions.py and skills/learned-workflow-patterns.md. This repo is public, so it was published.

All four are field-run credits and one aside in prose. None is load bearing: the name says who the run was for, and every finding stands without it. Replaced with the descriptive anonymisation the denylist file itself prescribes, matching how other field runs are credited in the changelog.

This is a forward fix only. The name stays in the history of the two commits that introduced it. Removing it from history is a separate decision and is deliberately not taken here.

One thing worth fixing in the guard itself, not done in this PR: the denylist entry that catches this name was added on 2026-08-20, after the commits that introduced it. The guard hard-fails on an absent denylist but has no notion of a stale one, so nothing re-scanned the tree when the entry was added. It surfaced only because a later commit happened to run the hook.

2. fix(source-ledger): keep glob wildcards in register waiver lines

The bug

The register parser stripped every literal * from a line before matching it:

l = re.sub(r'^[ \t>*_-]+', '', line.rstrip('\n')).replace('*', '')

The .replace('*', '') was there to remove markdown bold. It also destroyed glob wildcards in Waived source <glob>: reason lines, so InputCodeExamples/SomeCorpus/* became InputCodeExamples/SomeCorpus/ and then matched zero files through fnmatch.

Directory level waivers were silently non-functional. Only exact paths and basenames ever worked. Silently is the operative word: the line is accepted, it just waives nothing, so the ledger reports the files as missing and the author assumes they wrote the glob wrong.

Found on a migration whose corpus mixed one in-scope source folder with about 1,800 unrelated workshop example files across 8 directories. The only workaround the bug left was one waiver line per file, which is not a workaround at that scale.

The fix, and why it is two halves not one

Dropping the blanket strip is only half of it. Doing just that trades one silent bug for a worse one, in the opposite direction:

register line	before	naive fix	this PR
Waived source dir/*: r	key dir/, matches nothing	dir/*, correct	dir/*, correct
Waived source **one.pdf**: r	key one.pdf, correct	**one.pdf**, also waives one.pdf.bak	one.pdf, correct
**Waived source** one.pdf: r	key one.pdf, correct	no match at all	one.pdf, correct

A waiver means "out of scope", so a widened key silently hides files nobody named. That is the more dangerous direction of the two, which is why bold markers are now removed precisely rather than by stripping every star. The lookarounds require a path character beside the **, so a bold pair hugging a path is removed while dir/** and **/*.bak survive untouched.

Verification

Adversarially regression tested before opening this, not just unit tested:

• Every register on this machine was diffed old parser against new. 25 registers, 4535 lines, 12 Waived source lines. Exactly one register parses differently, and it parses differently in the intended direction. No register anywhere uses a bold spelling, and gate-check.sh --waive never writes one, so the bold cases are a latent hazard for hand-edited registers rather than a live regression.
• On the project that found it: waived 4, missing 1805, FAIL before; waived 1809, missing 0, PASS after, with the 3 genuinely in-scope files EXTRACTED and name-verified.
• Tests: tests/wave2/test-source-ledger.sh 43/43 (was 42, new T13), tests/wave2/test-source-sufficiency-gate.sh 7/7.

New fixture T13 pins both halves: a directory glob waives its 3 files, two bold spellings waive exactly their own file, and the neighbouring .bak is left alone.

Two pre-existing items found while testing, not touched here

Both predate this change and neither is caused by it:

1. gate-check.sh register_set_line and reg_field still gsub(/\*/, "") when looking up an existing label, so re-running --waive 'dir/*' appends a second line rather than replacing the first. Harmless today because the dict's last write wins, but the writer and the reader now disagree about what * means.
2. In source-ledger.sh the waiver branch runs before the on-disk check, so a waived file that is no longer on disk never reports MISSING.

Happy to fix either in a follow-up if you want them.

🤖 Generated with Claude Code

[MendixMau]

Superseded by #80, now merged as dc3b236. It carries both of this PR's commits unchanged plus the follow-up the triage found: single-* emphasis around a waiver key no longer widens the waiver (the same widening this PR's own commit message called the worse failure, one marker narrower), the --waive message and interview-protocol.md now say globs are accepted, and fixture T14 pins it (46/46). Thank you for the field find on the 1,800-file corpus, it is credited on the CHANGELOG line.

---

Generated by Claude Code