Burn down the 35 scripts/ modules that run on import — the KNOWN_IMPORT_UNSAFE ledger from PR #10665

[claude]

Parent: #10631. Split out from PR #10665, which landed the rule and left this half deliberately undone.

PR #10665 taught check:entry-guard a second rule — a scripts/** file that exports a binding
must have every top-level statement that runs something behind the guard — and recorded the files
that already violate it in a ⛔ SHRINK-ONLY KNOWN_IMPORT_UNSAFE list so the gate is green on
the tree as it stands. Nothing new can join the list; these 35 are the standing debt.

The burn-down was kept out of that PR because its claim declared scripts/check-entry-guard.mjs,
and 35 gate scripts is the file surface other seats work in. It is safe to do in any number of
sittings: each file is independent, and the gate itself tells you when a line is ready to go.

Why each one matters

Measured by importing every exporting scripts/ file in a child process for its exports alone:
of the 39 unguarded exporters, 8 ended the importer mid-import and five of those exit 0, and 14
more ran the whole tool loudly. Three further leaks live in files that do carry a guard and leak
conditionally on the importer's argv (qa/qa-rollup.mjs, objectui-range.mjs) or on an env var
(ts-parse.mjs) — invisible to any clean-argv probe. Full table in PR #10665.

The remedy is mechanical, and needs no re-indentation

Five files here already use the inverted idiom, which wraps a trailing dispatch chain with a 4-line
insert and zero re-indentation of the existing branches:

import { isEntrypoint } from './invoked-as.mjs'; // '../invoked-as.mjs' from a subdir

const invokedDirectly = isEntrypoint(import.meta.url);

if (!invokedDirectly) {
 // imported as a module — expose the exports and do nothing else
} else if (process.argv.includes('--self-test')) {
 ...

The plain form if (isEntrypoint(import.meta.url)) { ... } is equally accepted, as is storing the
predicate in a const under any name.

Roughly five of the 35 have their whole gate body at top level rather than a trailing dispatch
chain (check-error-status-conformance.mjs, checklist-select.mjs,
check-query-options-erasure-ratchet.mjs, check-release-page-status.mjs,
pm/check-governed-prose.mjs) and need a real main() extraction rather than a wrap. Those are
worth their own sitting.

⚠️ pm/check-governed-prose.mjs additionally mutates process.argv at module scope to filter
--self-test out before importing a sibling. That workaround is a scar from exactly this class and
looks stale now that pm/check-governed-merges.mjs carries the guard — worth checking rather than
preserving.

Per file: verify, then delete its line

For each one: add the guard, then node scripts/check-entry-guard.mjs — it fails with the file
named as a STALE KNOWN_IMPORT_UNSAFE entry, which is the signal to delete that line. Confirm
with an import probe (the importer must survive silently) and by running the file as a CLI
unchanged. Demonstrated end to end on check-nul-bytes.mjs in PR #10665.

The 35

• scripts/ablation-dist-preflight.mjs
• scripts/check-changeset-no-major.mjs
• scripts/check-dispatcher-error-vocabulary.mjs
• scripts/check-driver-memory-census.mjs
• scripts/check-empty-changeset.mjs
• scripts/check-engine-split-ratio.mjs
• scripts/check-error-code-casing.mjs
• scripts/check-error-status-conformance.mjs
• scripts/check-examples-live-imports.mjs
• scripts/check-filter-alias-parity.mjs
• scripts/check-nul-bytes.mjs
• scripts/check-org-identifier.mjs
• scripts/check-query-options-erasure-ratchet.mjs
• scripts/check-quick-reference-counts.mjs
• scripts/check-ratchet-remedy-authority.mjs
• scripts/check-release-page-status.mjs
• scripts/check-required-contexts.mjs
• scripts/check-route-envelope.mjs
• scripts/check-runtime-services-index.mjs
• scripts/check-shard-attestation.mjs
• scripts/check-spec-parsed-alias.mjs
• scripts/check-startup-registry-verdict.mjs
• scripts/check-tenant-chokepoint.mjs
• scripts/check-test-completeness.mjs
• scripts/check-workflow-status-functions.mjs
• scripts/checklist-select.mjs
• scripts/docs-audit/check-audit-scope.mjs
• scripts/measure-test-shard-timings.mjs
• scripts/objectui-range.mjs
• scripts/pm/check-governed-prose.mjs
• scripts/pm/check-label-desc-cap.mjs
• scripts/pm/check-skill-id-lint.mjs
• scripts/pm/check-skill-line-ratchet.mjs
• scripts/qa/qa-rollup.mjs
• scripts/ts-parse.mjs

node scripts/check-entry-guard.mjs --list prints this live, with the offending line in each file.

---

Generated by Claude Code

[claude]

Claim — PM dispatch (devx seat), sitting 1 of N

• Session: c970724d-303c-5614-9d20-a3f92205cfad
• Branch: claude/issue-10667-entry-guard-burndown-1

Ledger re-read on origin/main = dd8172ee22 (fetched 2026-08-21T08:38:37Z), not adopted
from this card: KNOWN_IMPORT_UNSAFE still holds 35 entries, and the list matches the
card's exactly.

One correction worth recording: the card says the remedy was "demonstrated end to end on
check-nul-bytes.mjs in PR #10665", which reads as if that file were already cleared.
It is still on the ledger at the current tip — #10665 demonstrated the method on it,
not the removal. So this is 35 to burn down, not 34.

Scope of this sitting: the mechanical wrap only. The agent is told to stop and leave a
file on the ledger, rather than force it, whenever the remedy is more than the 4-line
isEntrypoint insert. That deliberately excludes:

• the five the card flags as needing a real main() extraction —
  check-error-status-conformance.mjs, checklist-select.mjs,
  check-query-options-erasure-ratchet.mjs, check-release-page-status.mjs,
  pm/check-governed-prose.mjs (which additionally mutates process.argv at module scope;
  the card is right that this wants checking rather than preserving);
• the three that leak conditionally on the importer's argv or env — qa/qa-rollup.mjs,
  objectui-range.mjs, ts-parse.mjs. These are invisible to a clean-argv probe, so the
  usual import probe cannot confirm them, and they need their own sitting with a probe built
  for that. ts-parse.mjs is additionally live in lint.yml:189.

The ledger is ⛔ SHRINK-ONLY, so a partial burn-down is safe by construction and the gate
itself names each line that has become stale.

No collision with this seat's four in-flight PRs — checked each against the ledger:
check-cross-package-test-inputs.mjs (#10566), check-platform-checklist.mjs (#10682),
pm/dispatch-gates.mjs (#10664) and docs-audit/affected-docs.mjs (#10674) are none of
them on it.

---

Generated by Claude Code