--- a/mrjunejune/test/production_bundle_exclusion_test.sh	Thu Aug 06 11:31:30 2026 -0700
+++ b/mrjunejune/test/production_bundle_exclusion_test.sh	Fri Aug 07 07:34:12 2026 -0700
@@ -3,12 +3,54 @@
 
 bundle="$1"
 
-if find "$bundle" -type f | grep -E '/jrpg/|pixel-mplus-12-regular'; then
-  echo "Production bundle contains development-only JRPG files" >&2
+# Dereference symlinks so we scan the actual file tree.
+# Assert at least one regular file exists to catch an empty/broken bundle.
+file_count=$(find -L "$bundle" -type f | wc -l)
+if [[ "$file_count" -eq 0 ]]; then
+  echo "Production bundle appears empty — no regular files found under $bundle" >&2
+  exit 1
+fi
+
+# ── No .env file (contains real AWS credentials in developer environment) ─────
+if find -L "$bundle" -type f -name ".env" | grep -q .; then
+  echo "Production bundle contains .env (credential file)" >&2
+  exit 1
+fi
+
+# ── No .config file (contains real secrets in developer environment) ──────────
+if find -L "$bundle" -type f -name ".config" | grep -q .; then
+  echo "Production bundle contains .config (secret file)" >&2
+  exit 1
+fi
+
+# ── No SQLite database, WAL, or SHM files ─────────────────────────────────────
+if find -L "$bundle" -type f \( -name "*.db" -o -name "*.db-wal" -o -name "*.db-shm" \) | grep -q .; then
+  echo "Production bundle contains a database or WAL/SHM file" >&2
   exit 1
 fi
 
-if grep -R -a -l -E '"/jrpg"|/jrpg/index\.html' "$bundle"; then
-  echo "Production bundle contains a development-only JRPG route" >&2
+# ── No AUTH_COOKIE_SECRET values (non-hex-chars after = are false positive safe) ─
+# Match a line that looks like AUTH_COOKIE_SECRET=<hex-looking value> (≥64 chars)
+if grep -R -a -l -E 'AUTH_COOKIE_SECRET=[0-9a-fA-F]{64}' "$bundle"; then
+  echo "Production bundle contains an AUTH_COOKIE_SECRET assignment with a secret value" >&2
   exit 1
 fi
+
+# ── No zenbu-scrypt hashes (bootstrap password hashes) ────────────────────────
+# The literal prefix "zenbu-scrypt$" followed by a v= parameter is the real hash
+# format; safe references are only in comments or test-fixture strings in binaries.
+# We scan text files only (config, scripts, yaml) — not compiled binaries.
+if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
+    -exec grep -l 'zenbu-scrypt\$v=' {} \;  | grep -q .; then
+  echo "Production bundle contains a zenbu-scrypt password hash in a config/script" >&2
+  exit 1
+fi
+
+# ── No mjj_session or mjj_guest raw token values in config/scripts ─────────────
+# Cookie *names* appear safely in source code; we check only config/script files.
+if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
+    -exec grep -lE 'mjj_session=[A-Za-z0-9_-]{20,}|mjj_guest=[A-Za-z0-9_-]{20,}' {} \; | grep -q .; then
+  echo "Production bundle contains raw mjj_session/mjj_guest token values" >&2
+  exit 1
+fi
+