Merge main into bundler-2/work

internal/public-hygiene-check.mjs

@@ -62,6 +62,11 @@ const LEAK = [
   [/\/home\/[a-z0-9_-]+\//i, 'local path (/home/…)'], [/\/Users\/[A-Za-z0-9_-]+\//, 'local path (/Users/…)'], [/[A-Z]:\\Users\\/, 'local path (C:\\Users\\…)'],
   [/\beco-dx\b/, 'internal folder name (eco-dx)'], [/qa-cycle/, 'internal folder name (qa-cycle)'], [/\b_archive\b/, 'internal folder name (_archive)'],
   [/localhost:(5174|3001|3033)\b/, 'dev-server URL'],
+  // ★ HARD in every mode (Driver-critical, 2026-09-24): field-access / visa data must never
+  // ship in ANY public tree -- it maps how workers enter closed countries. Found live-served
+  // before this rule existed. Filename AND content patterns, no strict-tier softening.
+  [/field-access-visas/, 'PRIVATE data-class: field-access/visa table (see data-private/README.md)'],
+  [/"visa_/, 'PRIVATE data-class: visa field in shipped data'],
 ]
 // ★ ADDED 2026-09-24 (public-exposure audit, policies P3/P4/P7). A public tree carries
 // ARTIFACTS, never PROCESS or operational context — each of these was found live in a public

library/scripts/research/build-tabulator-tables.mjs

@@ -1318,6 +1318,13 @@ const ROUTE = {
 for (const b of built) {
   const app = ROUTE[b.name];
   if (!app) continue;
+  // ★ THE LEAK THIS LOOP CAUSED (found live 2026-09-24, Driver-critical): emit() already
+  // respects PRIVATE_TABLES and writes those to data-private/ -- but THIS loop copied from
+  // out/tables into the BUNDLE's data dir without the same check, so field-access-visas.json
+  // landed in plugin-designs/key-cities/data/tables/, flowed into the public snapshot AND the
+  // served catalog, and was fetchable by anonymous clone + live 200. A privacy rule enforced
+  // at ONE of two writers is not a rule. Same check, both writers:
+  if (PRIVATE_TABLES.has(b.name)) continue;
   const dir = join(PROFILES, app, 'data', 'tables');
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(join(dir, `${b.name}.json`), readFileSync(join(TABLES, `${b.name}.json`)));