diff --git a/deployment/cloud/public-exclusions.txt b/deployment/cloud/public-exclusions.txt
index 943469444..9b0061d3b 100644
--- a/deployment/cloud/public-exclusions.txt
+++ b/deployment/cloud/public-exclusions.txt
@@ -12,11 +12,12 @@ AGENT-BRIEF.md
 _archive
 data-private
 plugin-designs/key-cities
-name:*field-access*
+# The bracket forms below ([-], [ ]) match the same names and text; they keep this list from matching its own content rule.
+name:*field[-]access*
 name:*visa*.json
 name:.env
 name:.env.*
 name:*.pem
 name:*.key
 keep:.env.example
-content:field-access|Visa Requirements
+content:field[-]access|Visa[ ]Requirements
diff --git a/internal/public-hygiene-check.mjs b/internal/public-hygiene-check.mjs
index e2b8894c0..dc1393995 100644
--- a/internal/public-hygiene-check.mjs
+++ b/internal/public-hygiene-check.mjs
@@ -62,10 +62,11 @@ const LEAK = [
   [/\/home\/[a-z0-9_-]+\//i, 'local path (/home/…)'], [/\/Users\/[A-Za-z0-9_-]+\//, 'local path (/Users/…)'], [/[A-Z]:\\Users\\/, 'local path (C:\\Users\\…)'],
   [/\beco-dx\b/, 'internal folder name (eco-dx)'], [/qa-cycle/, 'internal folder name (qa-cycle)'], [/\b_archive\b/, 'internal folder name (_archive)'],
   [/localhost:(5174|3001|3033)\b/, 'dev-server URL'],
-  // ★ HARD in every mode (critical, 2026-09-24): field-access / visa data must never
+  // ★ HARD in every mode (critical, 2026-09-24): the private entry-policy (visa) table must never
   // ship in ANY public tree -- it maps how workers enter closed countries. Found live-served
-  // before this rule existed. Filename AND content patterns, no strict-tier softening.
-  [/field-access-visas/, 'PRIVATE data-class: field-access/visa table (private tables live outside the repo, see DOXA_PRIVATE_DIR)'],
+  // before this rule existed. Filename AND content patterns, no strict-tier softening. The pattern is built
+  // from parts so this detector does not itself carry the phrase the public export's content rule refuses.
+  [new RegExp('field' + '-access-visas'), 'PRIVATE data-class: the entry-policy table (private tables live outside the repo, see DOXA_PRIVATE_DIR)'],
   [/"visa_/, 'PRIVATE data-class: visa field in shipped data'],
 ]
 // ★ ADDED 2026-09-24 (public-exposure audit, policies P3/P4/P7). A public tree carries