@hone-ai/cli 1.38.1 → 1.40.0

package/lib/block-grammar.js

@@ -74,6 +74,60 @@ function fencedSpans(text) {
   return { blocks, open: cur };
 }
 
+/**
+ * The inline code spans of ONE line, as ranges (HC-GF-341 rules, extracted by HC-GF-292 so there is ONE walker).
+ *
+ * CommonMark's rule, on a single line: a run of N backticks opens a span that closes at the next run of EXACTLY
+ * N backticks; a run with no equal-length closer on the line is literal text, masks nothing and does not stop the
+ * scan. OUTSIDE a span a backtick after an odd number of backslashes is escaped (it cannot open, nor be part of an
+ * opening run); INSIDE a span a backslash is only a character. A span never crosses a line break.
+ *
+ * LINEAR: the line is cut into backtick runs once, the runs of each length are listed in order, and an opener asks
+ * for the first later run of its length with a cursor that only moves forward. A backreference regex backtracks
+ * across every longer run and is quadratic on a line of mixed runs, and the line is agent-written text.
+ *
+ * `from`/`to` address `line`: [from, to) covers the delimiters too; the content is
+ * `line.slice(from + openLen, to - openLen)`.
+ *
+ * @returns {Array<{from:number, to:number, openLen:number}>} in ascending order, disjoint
+ */
+function inlineCodeSpans(line) {
+  const spans = [];
+  if (typeof line !== 'string' || line.indexOf('`') === -1) return spans;
+  const starts = [];
+  const lens = [];
+  for (let i = line.indexOf('`'); i !== -1;) {
+    let j = i + 1;
+    while (j < line.length && line.charCodeAt(j) === 96) j++;
+    starts.push(i);
+    lens.push(j - i);
+    i = line.indexOf('`', j);
+  }
+  const runsOfLength = new Map(); // length -> { at: ascending run indices, p: cursor }
+  for (let k = 0; k < starts.length; k++) {
+    let entry = runsOfLength.get(lens[k]);
+    if (!entry) { entry = { at: [], p: 0 }; runsOfLength.set(lens[k], entry); }
+    entry.at.push(k);
+  }
+  const closerFor = (width, after) => {
+    const entry = runsOfLength.get(width);
+    if (!entry) return -1;
+    while (entry.p < entry.at.length && entry.at[entry.p] <= after) entry.p++;
+    return entry.p < entry.at.length ? entry.at[entry.p] : -1;
+  };
+  for (let k = 0; k < starts.length;) {
+    let slashes = 0;
+    for (let q = starts[k] - 1; q >= 0 && line.charCodeAt(q) === 92; q--) slashes++;
+    const escaped = slashes & 1; // 1: the run's first backtick is a literal one
+    const width = lens[k] - escaped;
+    const closer = width > 0 ? closerFor(width, k) : -1;
+    if (closer === -1) { k++; continue; }
+    spans.push({ from: starts[k] + escaped, to: starts[closer] + lens[closer], openLen: width });
+    k = closer + 1;
+  }
+  return spans;
+}
+
 /**
  * A `file:` block as one regex: group 1 the fence, 2 the path, 3 the body.
  *
@@ -117,6 +171,7 @@ module.exports = {
   fenceWidth,
   closesFence,
   fencedSpans,
+  inlineCodeSpans,
   DIRECTIVE_RE,
   FILE_BLOCK_RE,
   EDIT_BLOCK_RE,

package/lib/branch-protection.js

@@ -17,14 +17,24 @@
  *  mergeContexts(existing, added)
  *      Pure. Dedupes context names and preserves first-seen order so a
  *      pre-existing custom check (e.g. 'lint') is preserved when Hone
- *      appends 'ai-code-review'.
+ *      appends the checks it requires.
+ *
+ *  pruneLegacyChecks(contexts, { reportedChecks, keep })
+ *      Pure. Removes LEGACY_REQUIRED_CHECK ('ai-code-review'), which earlier
+ *      setups required and no served workflow reports (HC-GF-348), unless a
+ *      workflow in the repository reports it or the caller requires it.
+ *      Removes nothing else.
  *
  *  parseGhError(stderr, exitCode)
  *      Pure. Classifies a `gh` invocation failure into a stable kind:
  *      no-gh / no-auth / no-admin / plan-restricted / org-ruleset / unknown.
  *
  *  installBranchProtection({ exec?, log?, opts? })
- *      Orchestrator. Returns { status, reason?, branch?, manualCommand? }
+ *      Orchestrator. opts.requiredChecks is the list `hone setup` reads from
+ *      the installed workflow (cli/lib/required-checks.js) and may be empty;
+ *      opts.reportedChecks is every check name the repository's workflows
+ *      report (null = unknown, which keeps the legacy check).
+ *      Returns { status, reason?, branch?, manualCommand? }
  *      where status ∈ 'installed' | 'skipped' | 'failed'. Never throws,
  *      never exits — degrades gracefully so `hone setup` always returns 0.
  *
@@ -34,7 +44,14 @@
  * invocations during testing.
  */
 
-const DEFAULT_REQUIRED_CHECKS = ['ai-code-review'];
+// HC-GF-348: no check is required by default. Setup passes the checks the repository's own workflow
+// reports (cli/lib/required-checks.js); an empty list is valid — the PUT still requires a review and
+// sets enforce_admins. This used to be ['ai-code-review'], a check nothing reports, which held every PR.
+const DEFAULT_REQUIRED_CHECKS = [];
+
+// The one context an earlier `hone setup` installed that no served workflow reports. Re-running setup
+// removes it (pruneLegacyChecks), so a repository already held by it is released.
+const LEGACY_REQUIRED_CHECK = 'ai-code-review';
 
 // ─────────────────────────────────────────────────────────────────────
 // defaultExec — production exec, wraps spawnSync
@@ -59,7 +76,8 @@ function buildPayload({ contexts = [], requireReviews } = {}) {
   for (const c of contexts) {
     if (!seen.has(c)) { seen.add(c); dedupedContexts.push(c); }
   }
-  const reviewCount = typeof requireReviews === 'number' && requireReviews > 0
+  // 0 is a real answer since HC-GF-353 (a repository with one writer); anything that is not a count is 1.
+  const reviewCount = Number.isInteger(requireReviews) && requireReviews >= 0
     ? requireReviews
     : 1;
   return {
@@ -90,13 +108,27 @@ function mergeContexts(existing, added) {
   return out;
 }
 
+// ─────────────────────────────────────────────────────────────────────
+// pruneLegacyChecks — pure (HC-GF-348)
+// ─────────────────────────────────────────────────────────────────────
+function pruneLegacyChecks(contexts, { reportedChecks = [], keep = [] } = {}) {
+  const arr = Array.isArray(contexts) ? contexts : [];
+  // null: the repository's workflows could not all be read, so whether one reports it is unknown.
+  if (reportedChecks == null) return arr.slice();
+  const reported = Array.isArray(reportedChecks) ? reportedChecks : [];
+  const kept = Array.isArray(keep) ? keep : [];
+  if (reported.includes(LEGACY_REQUIRED_CHECK) || kept.includes(LEGACY_REQUIRED_CHECK)) return arr.slice();
+  return arr.filter((c) => c !== LEGACY_REQUIRED_CHECK);
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // parseGhError — pure
 // ─────────────────────────────────────────────────────────────────────
 function parseGhError(stderr = '', exitCode = 0) {
   const s = String(stderr || '');
   // gh binary missing entirely
-  if (exitCode === 127 || /command not found|gh:.*not found/i.test(s)) {
+  // Not GitHub's own `gh: Not Found (HTTP 404)`, which the shell's wording also matched.
+  if (exitCode === 127 || /command not found/i.test(s) || (/gh:.*not found/i.test(s) && !/\(HTTP \d{3}\)/.test(s))) {
     return { kind: 'no-gh', message: 'gh CLI not installed (or not on PATH)' };
   }
   // gh installed but not authenticated
@@ -128,28 +160,67 @@ function parseGhError(stderr = '', exitCode = 0) {
 // ─────────────────────────────────────────────────────────────────────
 // buildManualCommand — produces a copy-paste shell snippet for the user
 // ─────────────────────────────────────────────────────────────────────
-function buildManualCommand({ contexts = DEFAULT_REQUIRED_CHECKS, owner = '<owner>', repo = '<repo>', branch = 'main' } = {}) {
-  const contextLines = contexts
-    .map(c => `  -f 'required_status_checks[contexts][]=${c}' \\`)
-    .join('\n');
+function buildManualCommand({ contexts = DEFAULT_REQUIRED_CHECKS, owner = '<owner>', repo = '<repo>', branch = 'main', requireReviews } = {}) {
+  // HC-GF-348: the exact payload setup PUTs, sent as JSON. `-f` fields cannot carry an empty contexts
+  // list (now the default) or a null `restrictions` — `-f 'restrictions='` sent the empty string.
   return [
-    `gh api --method PUT repos/${owner}/${repo}/branches/${branch}/protection \\`,
-    `  -f 'required_status_checks[strict]=true' \\`,
-    contextLines,
-    `  -f 'enforce_admins=true' \\`,
-    `  -f 'required_pull_request_reviews[required_approving_review_count]=1' \\`,
-    `  -f 'restrictions='`,
+    `gh api --method PUT repos/${owner}/${repo}/branches/${branch}/protection --input - <<'JSON'`,
+    JSON.stringify(buildPayload({ contexts, requireReviews }), null, 2),
+    'JSON',
   ].join('\n');
 }
 
+// ─────────────────────────────────────────────────────────────────────
+// resolveChecks — the required list, which may depend on the branch (HC-GF-354)
+// ─────────────────────────────────────────────────────────────────────
+// Setup's list depends on the protected branch, which only `gh repo view` names. On the paths that return
+// before that, the printed manual command is a template, so the list is resolved with branch null. A
+// resolver that throws requires nothing rather than failing the install.
+function resolveChecks(requiredChecks, branch) {
+  if (typeof requiredChecks === 'function') {
+    try {
+      const r = requiredChecks(branch);
+      return Array.isArray(r) ? r : [];
+    } catch {
+      return [];
+    }
+  }
+  return Array.isArray(requiredChecks) ? requiredChecks : DEFAULT_REQUIRED_CHECKS;
+}
+
+// ─────────────────────────────────────────────────────────────────────
+// countWriters — how many people can push (HC-GF-353)
+// ─────────────────────────────────────────────────────────────────────
+function countWriters(exec, owner, repo) {
+  let r;
+  try {
+    r = exec('gh', ['api', '--paginate', `repos/${owner}/${repo}/collaborators?per_page=100`]);
+  } catch (e) {
+    return { count: null, reason: `gh could not be run: ${e && e.message}` };
+  }
+  if (r.status !== 0) return { count: null, reason: parseGhError(r.stderr, r.status).message };
+  let list;
+  try {
+    // --paginate concatenates one JSON array per page: `[...][...]`.
+    const pages = JSON.parse(`[${String(r.stdout || '').trim().replace(/\]\s*\[/g, '],[')}]`);
+    list = pages.length && pages.every(Array.isArray) ? pages.flat() : null;
+  } catch {
+    list = null;
+  }
+  if (!Array.isArray(list) || list.length === 0) return { count: null, reason: 'the collaborator list could not be read' };
+  const n = list.filter((c) => c && c.permissions && (c.permissions.push === true || c.permissions.admin === true)).length;
+  // Nobody with a readable push or admin permission is an answer that could not be read, not "zero
+  // writers": it must never remove the review.
+  if (n === 0) return { count: null, reason: 'no collaborator in the list has a readable push or admin permission' };
+  return { count: n };
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // installBranchProtection — orchestrator
 // ─────────────────────────────────────────────────────────────────────
 async function installBranchProtection({ exec = defaultExec, log = () => {}, opts = {} } = {}) {
-  const requiredChecks = (opts.requiredChecks && opts.requiredChecks.length)
-    ? opts.requiredChecks
-    : DEFAULT_REQUIRED_CHECKS;
-  const requireReviews = opts.requireReviews || 1;
+  // Not given: unknown, which keeps the legacy check. Only a caller that read the workflows can prune it.
+  const reportedChecks = opts.reportedChecks === undefined ? null : opts.reportedChecks;
 
   // 1. Honor opt-out — short-circuit before any subprocess call
   if (opts.skip) {
@@ -159,6 +230,12 @@ async function installBranchProtection({ exec = defaultExec, log = () => {}, opt
     };
   }
 
+  // An explicit list — empty included — is what the caller requires (HC-GF-348); a function of the
+  // protected branch (HC-GF-354); none given: the default. `requiredChecks` is the answer before the
+  // branch is known: for a function that is nothing, since a check it would name might never report on
+  // the real branch, and the manual command printed on those paths is a template the user edits.
+  const requiredChecks = typeof opts.requiredChecks === 'function' ? [] : resolveChecks(opts.requiredChecks, null);
+
   // 2. Resolve git remote
   const remote = exec('git', ['remote', 'get-url', 'origin']);
   if (remote.status !== 0) {
@@ -206,10 +283,23 @@ async function installBranchProtection({ exec = defaultExec, log = () => {}, opt
     };
   }
 
+  const branchChecks = resolveChecks(opts.requiredChecks, branch);
+
   // 4. GET existing protection (404 = none, 200 = merge)
   const protPath = `repos/${owner}/${repo}/branches/${branch}/protection`;
   const existing = exec('gh', ['api', protPath]);
   let existingContexts = [];
+  // HC-GF-348: only "Branch not protected" (HTTP 404) means there is nothing to merge. Any other failure
+  // to read the protection must not be taken for "none": the PUT replaces the contexts, so it would drop
+  // every check the repository already requires — and with this story the computed list can be empty.
+  if (existing.status !== 0 && !/Branch not protected/i.test(`${existing.stderr || ''}${existing.stdout || ''}`)) {
+    const err = parseGhError(existing.stderr, existing.status);
+    return {
+      status: 'failed',
+      reason: `could not read the existing branch protection, so it was left unchanged: ${err.message}`,
+      manualCommand: buildManualCommand({ contexts: branchChecks, owner, repo, branch }),
+    };
+  }
   if (existing.status === 0) {
     try {
       const e = JSON.parse(existing.stdout || '{}');
@@ -220,11 +310,32 @@ async function installBranchProtection({ exec = defaultExec, log = () => {}, opt
       existingContexts = [];
     }
   }
-  // (non-zero exit is treated as "no existing protection" — the PUT below will succeed if the user has permissions)
 
-  // 5. Build merged payload
-  const mergedContexts = mergeContexts(existingContexts, requiredChecks);
-  const payload = buildPayload({ contexts: mergedContexts, requireReviews });
+  // 5. Build merged payload; drop the legacy check an earlier setup installed (HC-GF-348)
+  const mergedContexts = pruneLegacyChecks(mergeContexts(existingContexts, branchChecks), {
+    reportedChecks, keep: branchChecks,
+  });
+
+  // HC-GF-353: GitHub does not count a PR author's approval of their own PR, so one required review on a
+  // repository with a single writer makes every PR unmergeable. An explicit opts.requireReviews wins. A
+  // count that could not be established keeps 1: failing open on human review would be the regression.
+  let reviewCount = 1;
+  let reviewReason;
+  if (Number.isInteger(opts.requireReviews) && opts.requireReviews >= 0) {
+    reviewCount = opts.requireReviews;
+    reviewReason = 'set by the caller';
+  } else {
+    const w = countWriters(exec, owner, repo);
+    if (w.count == null) {
+      reviewReason = `the number of people who can push could not be counted (${w.reason}), so one review is still required`;
+    } else if (w.count === 1) {
+      reviewCount = 0;
+      reviewReason = 'one person can push, and GitHub does not count a pull request author\'s own approval; a pull request is still required';
+    } else {
+      reviewReason = `${w.count} people can push`;
+    }
+  }
+  const payload = buildPayload({ contexts: mergedContexts, requireReviews: reviewCount });
 
   // 6. PUT
   const put = exec(
@@ -233,7 +344,7 @@ async function installBranchProtection({ exec = defaultExec, log = () => {}, opt
     { input: JSON.stringify(payload) }
   );
   if (put.status === 0) {
-    return { status: 'installed', branch };
+    return { status: 'installed', branch, requiredChecks: mergedContexts, reviewCount, reviewReason };
   }
 
   // 7. PUT failed — classify and return graceful failure
@@ -241,16 +352,21 @@ async function installBranchProtection({ exec = defaultExec, log = () => {}, opt
   return {
     status: 'failed',
     reason: err.message,
-    manualCommand: buildManualCommand({ contexts: mergedContexts, owner, repo, branch }),
+    manualCommand: buildManualCommand({ contexts: mergedContexts, owner, repo, branch, requireReviews: reviewCount }),
   };
 }
 
 module.exports = {
   buildPayload,
   mergeContexts,
+  pruneLegacyChecks,
+  resolveChecks,
+  countWriters,
   parseGhError,
   installBranchProtection,
   // Internal helpers exposed for inspection / future reuse
   buildManualCommand,
+  defaultExec,
   DEFAULT_REQUIRED_CHECKS,
+  LEGACY_REQUIRED_CHECK,
 };

package/lib/bundle-paths.js

@@ -256,8 +256,20 @@ function extractPathRefs(text) {
   return out;
 }
 
-/** Backticked spans in a story, longest first — the longest is the most specific anchor. */
-const BACKTICKED_RE = /`([^`\n]{3,200})`/g;
+/**
+ * Backticked spans in a story, PAIRED FIRST and length-unbounded; `storyTermsOf` applies the
+ * 3-to-200 rule to each paired span. HC-GF-188-followup-2.
+ *
+ * A BOUND INSIDE THE MATCH DECIDES WHICH BACKTICKS PAIR. At `` `x`, and `foo` `` the opening
+ * backtick of `x` could not start a 3-character match, so its CLOSING backtick did: the span ran
+ * to `foo`'s OPENING backtick, the "term" was `, and`, and `foo` was lost because no backtick was
+ * left to open it. A span over 200 characters, and an empty pair, shift the pairing the same way.
+ *
+ * The pairing is the one `maskCodeSpans` uses below: one rule for what a code span is, and the
+ * filter decides which spans can anchor. Fences are NOT masked here, which would widen the change
+ * past what the row measured.
+ */
+const BACKTICKED_RE = /`([^`\n]*)`/g;
 
 /**
  * The terms a story quotes that could locate code, longest first — one copy of the filter.
@@ -269,7 +281,8 @@ const BACKTICKED_RE = /`([^`\n]{3,200})`/g;
 function storyTermsOf(storyText) {
   return [...String(storyText || '').matchAll(BACKTICKED_RE)]
     .map((m) => m[1].trim())
-    .filter((c) => c.length >= 3
+    // Both bounds read the TRIMMED span; the ceiling used to live in the regex, on the raw span.
+    .filter((c) => c.length >= 3 && c.length <= 200
       && !new RegExp(`^[\\w.\\-/]+\\.(?:${FILE_EXT})$`).test(c)
       && !new RegExp(`^(?:${EXTENSIONLESS})$`).test(c))
     .sort((a, b) => b.length - a.length);
@@ -325,6 +338,17 @@ function anchorLineForStory(content, storyText) {
  *
  * The fallback is the OLD behaviour on purpose: a term that is only ever mentioned still
  * gets the operator a window near it, which beats none.
+ *
+ * HC-GF-203-followup-1: a MENTION is the term standing whole, not the term's letters inside a
+ * longer identifier. The fallback was a bare `indexOf`, so `info` landed in `information`,
+ * `auth` in `authorize` and `Promise.all` in `Promise.allSettled` — and each such offset became
+ * a site in `anchorSitesForStory`, spending one of its 6 slots and a window on text that does
+ * not contain the term. Measured 2026-10-07 at the production cap over every roadmap row
+ * against cli/hone-cli.js and server/src/services/orchestrator.js: 187 of 6,210 sites, in 161
+ * of 1,224 windowed excerpts, 106 of them at the 6-site limit, where the wasted slot cost
+ * another term its window. A term that never stands whole is now -1, exactly like a term
+ * the file lacks: HC-GF-188's rule, "could not anchor" stays distinguishable from "anchored
+ * here", applies to a window around `information` as much as to one around line 1.
  */
 /**
  * HC-GF-206-followup-1: a collapsed hit is a real site — the collapse only means it EXPECTS to
@@ -355,6 +379,11 @@ function anchorSitesForStory(content, storyText, max = 6) {
     if (def === -1) continue;
     const t = anchor.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     const offsets = [def];
+    // The STRICT form on purpose, unlike `wholeTerm`. HC-GF-206-followup-5 measured `wholeTerm` here:
+    // a term with a punctuation edge (`/prompts/`, `.json`) then takes every occurrence as a site and
+    // crowds the rest out of the 6 — 74 of 1,218 excerpts changed, 9 terms gained a window, 28 lost one.
+    // With the strict form such a term gets its first whole occurrence (`def`), and the marker names
+    // it when no window shows it.
     for (const m of text.matchAll(new RegExp(`(?<![\\w$])${t}(?![\\w$])`, 'g'))) offsets.push(m.index);
     for (const off of offsets) {
       const line = text.slice(0, off).split('\n').length;
@@ -370,8 +399,29 @@ function anchorSitesForStory(content, storyText, max = 6) {
   return { sites, collapsed };
 }
 
+/**
+ * A term standing WHOLE — HC-GF-203-followup-1: no identifier character touches an edge of the term
+ * that is itself an identifier character. `checkBudget(` stands whole in `checkBudget(orgId)` — its
+ * own `(` is the boundary on that side — and `info` does not in `information`.
+ *
+ * HC-GF-206-followup-5: one copy, read by `definitionIndexOf` and `unanchoredTerms`. With the strict
+ * `(?<![\w$])…(?![\w$])` in `unanchoredTerms`, the two disagreed on every term with a punctuation
+ * edge: `definitionIndexOf` found `checkBudget(` and the marker said nothing, because the strict
+ * form calls it absent. `anchorSitesForStory`'s scan for further hits deliberately keeps the strict
+ * form; see there.
+ *
+ * @returns {{t: string, before: string, after: string}} the escaped term and the two lookarounds
+ */
+function wholeTerm(term) {
+  return {
+    t: term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'),
+    before: /^[\w$]/.test(term) ? '(?<![\\w$])' : '',
+    after: /[\w$]$/.test(term) ? '(?![\\w$])' : '',
+  };
+}
+
 function definitionIndexOf(text, term) {
-  const t = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const { t, before, after } = wholeTerm(term);
   // Ordered by how strongly each shape asserts "this is where it lives".
   const DEFINITION_FORMS = [
     `\\.command\\(\\s*['"\`]${t}\\b`,           // CLI command registration
@@ -379,13 +429,16 @@ function definitionIndexOf(text, term) {
     `class\\s+${t}\\b`,                           // class declaration
     `(?:const|let|var)\\s+${t}\\s*=`,             // binding
     `exports\\.${t}\\s*=`,                        // named export
-    `${t}\\s*[:=]\\s*(?:async\\s*)?(?:function|\\()`, // property holding a function
+    // The one form with nothing in front of the term: without `before`, `name` is "defined"
+    // by `basename = (` and `run` by `rerun: function`.
+    `${before}${t}\\s*[:=]\\s*(?:async\\s*)?(?:function|\\()`, // property holding a function
   ];
   for (const form of DEFINITION_FORMS) {
     const m = new RegExp(form).exec(text);
     if (m) return m.index;
   }
-  return text.indexOf(term);
+  const mention = new RegExp(`${before}${t}${after}`).exec(text);
+  return mention ? mention.index : -1;
 }
 
 /**
@@ -402,9 +455,17 @@ function definitionIndexOf(text, term) {
  * Judged against the FINAL windows, not the site list, so it holds whatever dropped the term — the
  * site limit, the budget, a collapse — and needs no knowledge of how the layout was chosen.
  *
- * A term counts as occurring only where it stands as a whole word. `definitionIndexOf` falls back to
- * a bare `indexOf`, which finds `info` inside `information`; reporting that as "`info` is at line N"
- * would send an agent to a line that does not contain it.
+ * A term counts as occurring only where it stands whole (`wholeTerm`); reporting `info` inside
+ * `information` as "`info` is at line N" would send an agent to a line that does not contain it.
+ * `definitionIndexOf` applies the same rule since HC-GF-203-followup-1 (its fallback was a bare
+ * `indexOf`); the check here stays, because this is what names a term to the agent.
+ *
+ * HC-GF-206-followup-5: this read the strict form, which calls every term with a punctuation edge
+ * absent unless that edge happens to sit next to a non-identifier character. Measured 2026-10-07 at
+ * the production cap over every roadmap row against cli/hone-cli.js and orchestrator.js: 44 such
+ * terms in 40 of 1,218 windowed excerpts were in the file, in no window, and not named; and 42
+ * were named as outside every window while a window showed them (`.md` in `README.md`). After: 0 and
+ * 0, with every window byte-identical and no term pushed out of the marker or the notice.
  *
  * @param {string} content full file contents
  * @param {string} storyText
@@ -428,11 +489,10 @@ function unanchoredTerms(content, storyText, ranges) {
   for (const term of new Set(storyTermsOf(storyText))) {
     const def = definitionIndexOf(text, term);
     if (def === -1) continue;
-    const t = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const mentions = [...text.matchAll(new RegExp(`(?<![\\w$])${t}(?![\\w$])`, 'g'))].map((m) => lineOf(m.index));
+    const { t, before, after } = wholeTerm(term);
+    const mentions = [...text.matchAll(new RegExp(`${before}${t}${after}`, 'g'))].map((m) => lineOf(m.index));
     if (!mentions.length) continue;
-    // Covered only by a whole-word occurrence. The bundler may have anchored on `def` itself, but
-    // when `def` is the indexOf fallback that window shows `information`, not `info`.
+    // Covered only by a whole occurrence.
     if (mentions.some(covered)) continue;
     const defLine = lineOf(def);
     out.push({ term, line: mentions.includes(defLine) ? defLine : mentions[0] });
@@ -877,6 +937,10 @@ const LABEL_RE = /\*\*([A-Z][^*\n]{0,80}?):\*\*/g;
  * Fences are masked FIRST so a backtick inside a fence cannot pair with one
  * outside it.
  *
+ * HC-GF-188-followup-2: `BACKTICKED_RE` (read by `storyTermsOf`) pairs backticks the same way,
+ * `[^`\n]*` between two of them. Change the pairing in one place and change it in the other, or
+ * the two will disagree about what a code span is.
+ *
  * @param {string} text
  * @returns {string} same length as the input
  */