packets: the all-packets gate says how many ZONES it covered

"PACKETS-ALL: PASS — every generated packet renders, in every locale present"
is true and reads like "every packet is fine". It counts FILES. Only the zones
someone generated are ever in that directory.

MEASURED 2026-09-24: 11 packets, all of them the SAME zone (laos) in 11
locales, against 28 poster zones in out/posters. The suite proved one zone's
layout eleven times and had never rendered the other 27 -- any of which can
carry a different data shape: fewer groups, a missing photo, a map that does
not resolve. The packet gate itself is strong; the claim about its reach was
not.

It now prints "zones covered : N of M" with the zone names, and names the
shortfall. Running it today reports 2 of 28.

NOT a failure, deliberately. Generating 28 zones x 11 locales means a network
fetch per zone and ~100MB of artefacts; checking only what exists is a real
trade. The problem was never the cap, it was that the cap was silent -- a
summary line that overclaims is how a green board stops meaning anything. The
PASS text now ends with what it does NOT cover, and points at packet:ci, which
builds a second zone from a committed fixture with no network.

internal/check-packets-all.mjs

@@ -58,9 +58,34 @@ for (const f of files) {
   }
 }
 
+// ★ SAY HOW MANY ZONES THIS ACTUALLY COVERED. "every generated packet renders" is true and reads
+// like "every packet is fine" — but only the zones someone generated are ever here. MEASURED
+// 2026-09-24: 11 packets, ALL of them the SAME zone (laos) in 11 locales, against 28 poster zones
+// in out/posters. So the suite proved one zone's layout 11 times and had never rendered the other
+// 27, any of which could carry a different data shape (fewer groups, a missing photo, an
+// unresolvable map). A silent cap reads as full coverage; naming it is the difference between
+// "verified" and "verified what happened to be lying around".
+// NOT a failure — generating 28 zones x 11 locales means a network fetch per zone and ~100MB of
+// artefacts, which is a deliberate trade, not an oversight. The gate's job here is to stop the
+// PASS line from overclaiming.
+const zoneOf = (f) => f.replace(/\.html$/, '').replace(/\.[a-z]{2}$/, '')
+const zones = [...new Set(files.map(zoneOf))].sort()
+let totalZones = null
+try {
+  const postersDir = resolve(REPO, 'library/scripts/posters/out/posters')
+  if (existsSync(postersDir)) totalZones = readdirSync(postersDir).filter((f) => f.endsWith('.html')).length
+} catch { /* the denominator is a nicety; its absence must not fail the gate */ }
+
 console.log(`\nPACKETS-ALL: ${files.length} packet(s) checked, ${files.length - failed.length} passed`)
+console.log(`  zones covered : ${zones.length}${totalZones ? ` of ${totalZones}` : ''} — ${zones.join(', ')}`)
+if (totalZones && zones.length < totalZones) {
+  console.log(`  ⚠ ${totalZones - zones.length} zone(s) have NO packet here and were not rendered by`)
+  console.log('    anything. Generate another with: bun run packet:ci (one zone, committed fixture,')
+  console.log('    no network), or ONLY=<zone> node library/scripts/posters/packet.mjs.')
+}
 if (failed.length) {
   console.error(`PACKETS-ALL: FAIL — ${failed.length} packet(s): ${failed.join(', ')}`)
   process.exit(1)
 }
-console.log('PACKETS-ALL: PASS — every generated packet renders, in every locale present.')
+console.log(`PACKETS-ALL: PASS — every generated packet renders, across ${zones.length} zone(s) `
+  + 'and every locale present. This does NOT cover zones no one generated.')