The "[^] should be [!]" check also fires on bracket expressions
that are pattern data for other tools inside quoted strings, where
[^...] is the correct negation and [!...] would be wrong (in a
POSIX regular expression "!" in a bracket expression is literal).

(1) find(1) glob in a single-quoted string directly after a
double-quoted string (xdg-terminal-exec ships this shape):

    #!/bin/sh
    find "$dir"'./*[^a-z]*' -print

Actual output (checkbashisms 2.26.9, exit 1):

    possible bashism in test.sh line 2 ([^] should be [!]):
    find "$dir"'./*[^a-z]*' -print

(2) sed program in double quotes inside a command substitution
(distrobox-enter lines 244/247):

    #!/bin/sh
    flags="$(echo "$2" | sed -E "s/(--[a-z]+) ([^ ]+)/\1=\2/g")"

Actual output (checkbashisms 2.26.9, exit 1):

    possible bashism in test.sh line 2 ([^] should be [!]):
    flags="$(echo "$2" | sed -E "s/(--[a-z]+) ([^ ]+)/\1=\2/g")"

In both, [^...] is data for find/sed (POSIX ERE, XBD 9.4, negates
with ^). The checker's quoted-string segmentation misses spans
that are quote-adjacent ("..."'...') or interleaved
('...'"$var"'...'), exposing the pattern text to the shell checks;
the same miss accounts for the awk/sed instances in the corpus.

This is distinct from the archived #645586, which concerned
*unquoted* sed expressions; there the warning is correct, because
an unquoted [^...] is subject to shell globbing. Here the pattern
text is quoted.

[Hint: skip [^...] matches inside the quoted strings the checker
itself tracks.]

Found downstream (openSUSE/rpmlint corpus): 11 files.

Disclosure, encouraged by GR 2026-002: this report was drafted with
AI assistance; the reproducers were verified by me against
checkbashisms 2.26.9.