paperlint 8.0.0 → 9.0.1

package/fixtures/paper-sources/v3-declared/tex-truth.json

@@ -0,0 +1,28 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [],
+  "bibdata": [
+    "paper"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "paper.bib"
+    ],
+    "keys": [
+      "declared2023"
+    ],
+    "exit": 0,
+    "errors": []
+  },
+  "sha256": {
+    "paper.tex": "365c348f503b060973c7b1d5db0348659dffa91d7b149d10181204ae27e31dfb",
+    "paper.bib": "efe5f0577c8173e99be73ed728679904dcac9c90b1ec56350cf64d0771f8305e"
+  }
+}

package/fixtures/paper-sources/v30-name-next-line/paper.tex

@@ -0,0 +1,14 @@
+\documentclass{article}
+\begin{filecontents*}
+{refs.bib}
+@misc{nl2024,
+  title = {The Name on the Next Line},
+  author = {Doe, Jane},
+  year = {2024}
+}
+\end{filecontents*}
+\begin{document}
+Text that cites~\cite{nl2024}.
+\bibliographystyle{plain}
+\bibliography{refs}
+\end{document}

package/fixtures/paper-sources/v30-name-next-line/tex-truth.json

@@ -0,0 +1,30 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [
+    "refs.bib"
+  ],
+  "bibdata": [
+    "refs"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "refs.bib"
+    ],
+    "keys": [
+      "nl2024"
+    ],
+    "exit": 0,
+    "errors": []
+  },
+  "sha256": {
+    "paper.tex": "143d03485e70ffefc525e6f783601c6f71e6650ccf779c77a4d7a8f12ba6075b",
+    "refs.bib": "b4c47cdd91aff598589dae3f0f068495af3680e5cdf0bce4747332750812ee1d"
+  }
+}

package/fixtures/paper-sources/v4-commented/paper.tex

@@ -0,0 +1,14 @@
+\documentclass{article}
+% \begin{filecontents*}{refs.bib}
+% @misc{commented2024,
+%   title = {The Inline Entry},
+%   author = {Doe, Jane},
+%   year = {2024},
+%   url = {https://example.org/inline}
+% }
+% \end{filecontents*}
+\begin{document}
+Text that cites~\cite{commented2024} and~\cite{stale2020}.
+\bibliographystyle{plain}
+\bibliography{refs}
+\end{document}

package/fixtures/paper-sources/v4-commented/refs.bib

@@ -0,0 +1,6 @@
+@misc{stale2020,
+  title = {The Stale Entry},
+  author = {Roe, Rich},
+  year = {2020},
+  url = {https://example.org/stale}
+}

package/fixtures/paper-sources/v4-commented/tex-truth.json

@@ -0,0 +1,28 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [],
+  "bibdata": [
+    "refs"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "refs.bib"
+    ],
+    "keys": [
+      "stale2020"
+    ],
+    "exit": 0,
+    "errors": []
+  },
+  "sha256": {
+    "paper.tex": "a0a0349afca7a2de8b41bdbdf777de14d8e07df5993a351492ca11c858f8c34e",
+    "refs.bib": "7a720777755f3dd727c2428f66f06d5f818f367e41fe4c47543aa9f55adfebb4"
+  }
+}

package/fixtures/paper-sources/v5-percent-entry/paper.tex

@@ -0,0 +1,20 @@
+\documentclass{article}
+\begin{filecontents*}[overwrite]{refs.bib}
+@misc{inline2024,
+  title = {The Inline Entry},
+  author = {Doe, Jane},
+  year = {2024},
+  url = {https://example.org/inline}
+}
+% @misc{dead2020,
+%   title = {The Entry Behind a Percent Sign},
+%   author = {Moe, Max},
+%   year = {2020},
+%   url = {https://example.org/dead}
+% }
+\end{filecontents*}
+\begin{document}
+Text that cites~\cite{inline2024} and~\cite{dead2020}.
+\bibliographystyle{plain}
+\bibliography{refs}
+\end{document}

package/fixtures/paper-sources/v5-percent-entry/tex-truth.json

@@ -0,0 +1,37 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [
+    "refs.bib"
+  ],
+  "bibdata": [
+    "refs"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "refs.bib"
+    ],
+    "keys": [
+      "dead2020",
+      "inline2024"
+    ],
+    "exit": 2,
+    "errors": [
+      {
+        "message": "You're missing a field name",
+        "file": "refs.bib",
+        "line": 8
+      }
+    ]
+  },
+  "sha256": {
+    "paper.tex": "f520de6b9f34e249851913d2e9fc23532603378787b034e08e0b43e2bc111994",
+    "refs.bib": "247d564a35129b3fa087ae2541cd51130c1e6875fafe5dad36d694f6a4d1b7fc"
+  }
+}

package/fixtures/paper-sources/v6-unclosed/paper.tex

@@ -0,0 +1,6 @@
+\documentclass{article}
+\begin{document}
+\nocite{*}
+\bibliographystyle{plain}
+\bibliography{refs}
+\end{document}

package/fixtures/paper-sources/v6-unclosed/refs.bib

@@ -0,0 +1,5 @@
+@misc{a1, title={A}, author={A, B}, year={2020}, url={https://e.org/a1}}
+@misc{a2unclosed, title={Two}, author={A, B}, year={2020}, url={https://e.org/a2}
+
+@misc{a3, title={Three}, author={A, B}, year={2020}}
+% @misc{a4, title={Four}, author={A, B}, year={2020}}

package/fixtures/paper-sources/v6-unclosed/tex-truth.json

@@ -0,0 +1,37 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [],
+  "bibdata": [
+    "refs"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "refs.bib"
+    ],
+    "keys": [
+      "a1",
+      "a4",
+      "a3",
+      "a2unclosed"
+    ],
+    "exit": 2,
+    "errors": [
+      {
+        "message": "I was expecting a `,' or a `}'",
+        "file": "refs.bib",
+        "line": 4
+      }
+    ]
+  },
+  "sha256": {
+    "paper.tex": "9ad22f9c50070c2620c5bf8885ed53cee4b0901e7bfdc83c61f70902686ac5e0",
+    "refs.bib": "1d33d35cf2e384fc54acf45654493881315c98a4b494b952464668d33924aeec"
+  }
+}

package/fixtures/paper-sources/v8-jobname/paper.tex

@@ -0,0 +1,9 @@
+\documentclass{article}
+\begin{filecontents*}[overwrite]{\jobname.bib}
+@misc{jkey, title={J}, author={Doe, J}, year={2024}}
+% @misc{jdead, title={D}, author={Doe, J}, year={2020}}
+\end{filecontents*}
+\begin{document}
+Text~\cite{jkey}.
+\bibliographystyle{plain}\bibliography{\jobname}
+\end{document}

package/fixtures/paper-sources/v8-jobname/tex-truth.json

@@ -0,0 +1,30 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [
+    "paper.bib"
+  ],
+  "bibdata": [
+    "paper"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "paper.bib"
+    ],
+    "keys": [
+      "jkey"
+    ],
+    "exit": 0,
+    "errors": []
+  },
+  "sha256": {
+    "paper.tex": "d68bcaabe9be4cbc07f5a1e672e8cd448e96bc9b5134be350d2906ee48834482",
+    "paper.bib": "bc5a9faf4bbdcdf22705c4c8b69d656382ab9d1d03f57388c00631c3aa6ebf70"
+  }
+}

package/fixtures/paper-sources/v9-two-bibliographies/one.bib

@@ -0,0 +1 @@
+@misc{onekey, title={One}, author={A, B}, year={2020}}

package/fixtures/paper-sources/v9-two-bibliographies/paper.tex

@@ -0,0 +1,7 @@
+\documentclass{article}
+\begin{document}
+\nocite{*}
+\bibliographystyle{plain}
+\bibliography{one}
+\bibliography{two}
+\end{document}

package/fixtures/paper-sources/v9-two-bibliographies/tex-truth.json

@@ -0,0 +1,35 @@
+{
+  "schema": 1,
+  "inputs": [
+    {
+      "path": "paper.tex",
+      "role": "body"
+    }
+  ],
+  "written": [],
+  "bibdata": [
+    "one",
+    "two"
+  ],
+  "bibtex": {
+    "ran": true,
+    "databases": [
+      "one.bib"
+    ],
+    "keys": [
+      "onekey"
+    ],
+    "exit": 2,
+    "errors": [
+      {
+        "message": "Illegal, another \\bibdata command",
+        "file": "paper.aux",
+        "line": 5
+      }
+    ]
+  },
+  "sha256": {
+    "paper.tex": "f45db61354f01066eb49ab48d240033bea99ed172f04a2c4558daca8640ce796",
+    "one.bib": "61cca311ca7d77570ed410fc536c655ba76d36168fc3e56068235a2c4b16f7bf"
+  }
+}

package/fixtures/paper-sources/v9-two-bibliographies/two.bib

@@ -0,0 +1 @@
+@misc{twokey, title={Two}, author={A, B}, year={2020}}

package/fixtures/paper-typography/clean-paper/paper.tex

@@ -1,5 +1,5 @@
 \documentclass{acmart}
-\begin{filecontents*}{refs.bib}
+\begin{filecontents*}[overwrite]{refs.bib}
 @inproceedings{reachable,
   title  = {A paper a reader can actually open},
   author = {Doe, Jane},

package/fixtures/paper-typography/messy-paper/paper.tex

@@ -1,5 +1,5 @@
 \documentclass{acmart}
-\begin{filecontents*}{refs.bib}
+\begin{filecontents*}[overwrite]{refs.bib}
 @inproceedings{unreachableone,
   title  = {No doi, no url, no arXiv id},
   author = {Doe, Jane},

package/hooks/CLAUDE.md

@@ -0,0 +1,34 @@
+<!-- vigiles:sha256:0407b53b2036133e compiled from hooks/CLAUDE.md.spec.ts -->
+
+# CLAUDE.md
+
+## `hooks/`
+
+The hooks this package ships into a consumer's Claude Code session. Loaded when working under
+`hooks/`. Every shipped hook is run in both halves, firing and silent, by `hooks/hooks.harness.ts`.
+
+A bug here does not break this repository; it breaks somebody else's whole session. The Bash gate
+fails closed, so a hook that cannot read its config denies every command, including the one that
+would undo it.
+
+## Rules
+
+### Ship Hook Mjs Never Hook Ts
+
+**Guidance only** — A `.ts` hook inside `node_modules` fails to load and blocks every Bash command. Rejected, so not proposed again: a `.hook.ts` twin compiled to the `.mjs` (a twin drifts from its build, and nothing would notice), and a thin `.hook.ts` in the consumer importing the logic from here (`vigiles compile` refuses the import, so the hook can never be re-stamped, and the runtime fails closed on the stale stamp). [Measurements](https://github.com/zernie/paperlint/blob/b4a3dc3a81d436186f41db2d69b65fd93f1af3b6/CLAUDE.md#L272-L357).
+
+### No Sibling Imports
+
+**Guidance only** — A shipped hook cannot import a sibling module. The papers-root resolver is repeated in each hook, and `hooks.harness.ts` compares the copies.
+
+### No Import Shaped Text
+
+**Guidance only** — `checkHookImports` (run by `hooks.harness.ts`) is a text regex. Describe a forbidden import in words; never write one, not even in a comment.
+
+### One Wiring File
+
+**Guidance only** — The wiring is `plugin/hooks/hooks.json`. `paperlint init` merges it into the consumer's `.claude/settings.json`; there is no second copy.
+
+### Vigiles Moves With The Consumer
+
+**Guidance only** — `vigiles` moves with the consumer's pin, in one pass. A major mismatch makes `PreToolUse` refuse every command. `npm ls vigiles` compares what is installed with the manifest, not with the registry; Dependabot (`.github/dependabot.yml`) carries the registry half.

package/hooks/CLAUDE.md.spec.ts

@@ -0,0 +1,30 @@
+// Compiled to hooks/CLAUDE.md by `npx vigiles compile`. Edit THIS file, never the markdown.
+import { file, guidance, instructionFile, prose } from "vigiles/spec";
+
+export default instructionFile({
+  sections: {
+    "`hooks/`": prose`The hooks this package ships into a consumer's Claude Code session. Loaded when working under
+\`hooks/\`. Every shipped hook is run in both halves, firing and silent, by ${file("hooks/hooks.harness.ts")}.
+
+A bug here does not break this repository; it breaks somebody else's whole session. The Bash gate
+fails closed, so a hook that cannot read its config denies every command, including the one that
+would undo it.`,
+  },
+  rules: {
+    "ship-hook-mjs-never-hook-ts": guidance(
+      "A `.ts` hook inside `node_modules` fails to load and blocks every Bash command. Rejected, so not proposed again: a `.hook.ts` twin compiled to the `.mjs` (a twin drifts from its build, and nothing would notice), and a thin `.hook.ts` in the consumer importing the logic from here (`vigiles compile` refuses the import, so the hook can never be re-stamped, and the runtime fails closed on the stale stamp). [Measurements](https://github.com/zernie/paperlint/blob/b4a3dc3a81d436186f41db2d69b65fd93f1af3b6/CLAUDE.md#L272-L357).",
+    ),
+    "no-sibling-imports": guidance(
+      "A shipped hook cannot import a sibling module. The papers-root resolver is repeated in each hook, and `hooks.harness.ts` compares the copies.",
+    ),
+    "no-import-shaped-text": guidance(
+      "`checkHookImports` (run by `hooks.harness.ts`) is a text regex. Describe a forbidden import in words; never write one, not even in a comment.",
+    ),
+    "one-wiring-file": guidance(
+      "The wiring is `plugin/hooks/hooks.json`. `paperlint init` merges it into the consumer's `.claude/settings.json`; there is no second copy.",
+    ),
+    "vigiles-moves-with-the-consumer": guidance(
+      "`vigiles` moves with the consumer's pin, in one pass. A major mismatch makes `PreToolUse` refuse every command. `npm ls vigiles` compares what is installed with the manifest, not with the registry; Dependabot (`.github/dependabot.yml`) carries the registry half.",
+    ),
+  },
+});

package/lib/agent-cli-version.ts

@@ -95,7 +95,7 @@ export function observeAgentCli({
 
   // ⚠️ EXIT 0 AND NOTHING ON STDOUT IS NOT A CLEAN OBSERVATION — it is exactly what the discarded
   // probe looked like, and reporting `characterized against ""` would be the same lie in a new
-  // place. This is rule 4 of CLAUDE.md applied to the check that enforces it.
+  // place. This is the green zero of scripts/rules-see-files.mjs, applied to the check that enforces it.
   if (version === "")
     throw new Error(
       `\`${program} --version\` exited 0 but printed no version on stdout (got ${JSON.stringify(raw)}` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperlint",
-  "version": "8.0.0",
+  "version": "9.0.1",
   "description": "A linter for scientific papers written in LaTeX: catches mistakes before you submit to a conference or journal.",
   "type": "module",
   "license": "MIT",
@@ -20,6 +20,7 @@
   "dependencies": {
     "@eslint/markdown": "^8.0.3",
     "@eslint/plugin-kit": "^0.7.2",
+    "@retorquere/bibtex-parser": "^10.0.1",
     "@unified-latex/unified-latex-types": "^1.8.4",
     "@unified-latex/unified-latex-util-parse": "^1.8.4",
     "@unified-latex/unified-latex-util-visit": "^1.8.4",
@@ -33,11 +34,10 @@
     "ts-essentials": "^10.2.1",
     "typescript": "^6.0.3",
     "unpdf": "^1.8.1",
-    "vigiles": "^32.1.0",
+    "vigiles": "^38.2.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@retorquere/bibtex-parser": "^10.0.1",
     "@semantic-release/commit-analyzer": "13.0.1",
     "@semantic-release/release-notes-generator": "14.1.1",
     "@types/js-yaml": "^4.0.9",
@@ -56,14 +56,6 @@
     "typescript-eslint": "^8.70.1",
     "vitest": "^4.1.11"
   },
-  "peerDependencies": {
-    "@retorquere/bibtex-parser": "^10.0.1"
-  },
-  "peerDependenciesMeta": {
-    "@retorquere/bibtex-parser": {
-      "optional": true
-    }
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/zernie/paperlint.git"

package/plugin/CLAUDE.md

@@ -0,0 +1,22 @@
+<!-- vigiles:sha256:6312a3b8f9804eba compiled from plugin/CLAUDE.md.spec.ts -->
+
+# CLAUDE.md
+
+## `plugin/`
+
+Not a plugin any more. `plugin/hooks/hooks.json` is the hook wiring that `paperlint init` merges
+into the consumer's `.claude/settings.json`, and it is the only source of that wiring.
+
+## Why there is no Claude Code plugin
+
+There is no Claude Code plugin or marketplace entry; it was removed in the release after 1.0.0
+(#82). Do not bring it back without answering each of these, measured (`docs/install.md`,
+"Why it is shaped this way"):
+
+- **A plugin cannot carry the code.** Claude Code installs a plugin's dependencies with a 60-second
+  timeout, and a failed install never blocks the plugin: the hooks load and fail with
+  `cannot find module vigiles`, silently.
+- **The skills need the npm package anyway.** 23 of 24 skills ran scripts that resolve only through
+  `node_modules/paperlint/`.
+- **Its manifests carried versions nothing updated**, and Claude Code decides plugin updates from
+  that number.

package/plugin/CLAUDE.md.spec.ts

@@ -0,0 +1,22 @@
+// Compiled to plugin/CLAUDE.md by `npx vigiles compile`. Edit THIS file, never the markdown.
+import { file, instructionFile, prose } from "vigiles/spec";
+
+export default instructionFile({
+  sections: {
+    "`plugin/`": prose`Not a plugin any more. ${file("plugin/hooks/hooks.json")} is the hook wiring that \`paperlint init\` merges
+into the consumer's \`.claude/settings.json\`, and it is the only source of that wiring.`,
+
+    "Why there is no Claude Code plugin": prose`There is no Claude Code plugin or marketplace entry; it was removed in the release after 1.0.0
+(#82). Do not bring it back without answering each of these, measured (${file("docs/install.md")},
+"Why it is shaped this way"):
+
+- **A plugin cannot carry the code.** Claude Code installs a plugin's dependencies with a 60-second
+  timeout, and a failed install never blocks the plugin: the hooks load and fail with
+  \`cannot find module vigiles\`, silently.
+- **The skills need the npm package anyway.** 23 of 24 skills ran scripts that resolve only through
+  \`node_modules/paperlint/\`.
+- **Its manifests carried versions nothing updated**, and Claude Code decides plugin updates from
+  that number.`,
+  },
+  rules: {},
+});

package/scripts/check.test.ts

@@ -6,7 +6,7 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { test } from "vitest";
+import { test, vi } from "vitest";
 import {
   GATES,
   NOT_COVERED,
@@ -122,6 +122,28 @@ test("🔴 runGates: a vitest gate that exits 0 but leaves no report is a FAILUR
   );
 });
 
+test("🔴 every gate runs with CI=true, as CI runs it — a local check is the CI check", () => {
+  // Libraries change behaviour under CI=true (typescript-eslint infers a single run and parses from
+  // disk): a gate run without it passed locally and failed in CI on 2026-10-07.
+  // Whatever the caller's shell says: on CI it is already "true", so the test sets it otherwise.
+  vi.stubEnv("CI", "false");
+  const seen: (string | undefined)[] = [];
+  runGates({
+    gates: [
+      { name: "a", job: "gates", run: ["true"] },
+      { name: "b", job: "gates", script: "build" },
+    ],
+    spawn: (_cmd, _args, options) => {
+      seen.push(options.env["CI"]);
+      return { status: 0 };
+    },
+    write: () => {},
+    ...capture().io,
+  });
+  vi.unstubAllEnvs();
+  assert.deepEqual(seen, ["true", "true"]);
+});
+
 test("run as a program with every gate passing: the plain verdict, exit 0", () => {
   // spawnSync is replaced before check.ts loads, so the real file runs end to end — every gate
   // "passes" in microseconds instead of the eleven real ones running.

package/scripts/check.ts

@@ -30,8 +30,10 @@
  *
  * ── NO `--fast` FLAG, ON PURPOSE ───────────────────────────────────────────────────────────
  * A subset flag re-creates the exact failure above: the cheap half gets run and reported as
- * "the gates". The slow steps instead SKIP LOUDLY when their prerequisite is genuinely absent
- * (no TeX, no network), and the tail names every skip. "I ran check" then means one thing.
+ * "the gates". Every gate runs with CI=true, as in CI, so a local check is the CI check: the e2e
+ * steps are strict (`test/e2e/need.ts`) — a missing prerequisite (no TeX) FAILS with what to
+ * install, as it does in CI — and a test that still skips is named in the tail, never counted as a
+ * pass. "I ran check" then means one thing.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, rmSync } from "node:fs";
@@ -293,7 +295,9 @@ function runEach(
       cwd: ROOT,
       stdio: "inherit",
       encoding: "utf8",
-      env: { ...process.env, PATH: BIN_FIRST_PATH },
+      // CI=true, as CI runs every gate: libraries read it (typescript-eslint infers a single run and
+      // parses from disk), so without it a local check is not the CI check (2026-10-07).
+      env: { ...process.env, CI: "true", PATH: BIN_FIRST_PATH },
     });
     // 🔴 The exit code is read from the command itself, never from a pipe. `cmd | tail && …`
     // reports the FILTER's status, which is almost always zero — that is how a red harness

package/scripts/coverage-config.test.ts

@@ -21,7 +21,7 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { globSync, readFileSync } from "node:fs";
-import { dirname, join, matchesGlob, resolve } from "node:path";
+import { basename, dirname, join, matchesGlob, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import yaml from "js-yaml";
 import ts from "typescript";
@@ -146,16 +146,23 @@ test("every typeOnly exclusion has no runtime code", () => {
 });
 
 test("every evalOnly exclusion is imported only by an eval or another evalOnly module", () => {
-  const evalOnly = new Set(expand(CONFIG.evalOnly).map((f) => join(ROOT, f)));
+  const only = expand(CONFIG.evalOnly);
+  const evalOnly = new Set(only.map((f) => join(ROOT, f)));
+  // Any import of one names it — `./x.mjs`, `#lib/x` — so a source whose text holds none of their
+  // base names imports none of them, and only the others are parsed.
+  const names = only.map((f) => basename(f).replace(/\.[^.]+$/, ""));
   const sources = globSync("**/*.{mjs,ts}", {
     cwd: ROOT,
     exclude: (p) => p === "node_modules" || p === "dist" || p === "coverage",
   });
   const importers = sources.flatMap((f) => {
     const abs = join(ROOT, f);
-    return importedPaths(abs, readFileSync(abs, "utf8"))
-      .filter((target) => evalOnly.has(target))
-      .map(() => f);
+    const text = readFileSync(abs, "utf8");
+    return names.some((n) => text.includes(n))
+      ? importedPaths(abs, text)
+          .filter((target) => evalOnly.has(target))
+          .map(() => f)
+      : [];
   });
   const outsiders = importers.filter(
     (f) => !f.endsWith(".eval.mjs") && !evalOnly.has(join(ROOT, f)),
@@ -258,11 +265,13 @@ test("no measured source carries a coverage-ignore comment", () => {
   // The scan covers exactly what c8 measures: the same set, derived from the tracked files.
   assert.deepEqual(files, trackedSources().filter(isMeasured));
   assert.ok(files.length > 0);
-  const offenders = files.filter((f) =>
-    comments(f, readFileSync(join(ROOT, f), "utf8")).some((c) =>
-      IGNORE.test(c),
-    ),
-  );
+  // An ignore comment's text matches IGNORE, so a source whose text does not holds none, and only
+  // the others have their comments read off the tree.
+  const offenders = files
+    .map((f) => [f, readFileSync(join(ROOT, f), "utf8")] as const)
+    .filter(([, text]) => IGNORE.test(text))
+    .filter(([f, text]) => comments(f, text).some((c) => IGNORE.test(c)))
+    .map(([f]) => f);
   assert.deepEqual(offenders, []);
 });
 
@@ -391,8 +400,9 @@ test("the exclude list is exactly the justified set", () => {
     "**/*.test.*",
     // PAID LLM evaluations, never run by `npm test`
     "**/*.eval.mjs",
-    // skill sources vigiles compiles into SKILL.md
+    // skill and CLAUDE.md sources vigiles compiles; a glob's `**` skips a dot directory
     "**/*.spec.ts",
+    ".github/*.spec.ts",
     // type declarations
     "**/*.d.ts",
     "**/*.d.mts",