From 128c73d1c077ca068c4fef58482cd9a9cbb844f6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:49:54 +0000
Subject: [PATCH 01/25] fix(scripts): guard check-skill-id-lint against running
 on import

---
 scripts/check-entry-guard.mjs      | 1 -
 scripts/pm/check-skill-id-lint.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 9275060393..ddc92f4006 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -466,7 +466,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/pm/check-label-desc-cap.mjs',
-  'scripts/pm/check-skill-id-lint.mjs',
   'scripts/pm/check-skill-line-ratchet.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
diff --git a/scripts/pm/check-skill-id-lint.mjs b/scripts/pm/check-skill-id-lint.mjs
index 1044b5356a..a00c6354f6 100644
--- a/scripts/pm/check-skill-id-lint.mjs
+++ b/scripts/pm/check-skill-id-lint.mjs
@@ -47,6 +47,7 @@ import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = join(fileURLToPath(import.meta.url), '..', '..', '..');
 
@@ -203,5 +204,10 @@ function selfTest() {
   console.log(`✓ check-skill-id-lint self-test: ${cases.length} cases pass.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From 76943111e8e503eff05240615492305b4b3bbc8b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:51:20 +0000
Subject: [PATCH 02/25] fix(scripts): guard check-skill-line-ratchet against
 running on import

---
 scripts/check-entry-guard.mjs           | 1 -
 scripts/pm/check-skill-line-ratchet.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index ddc92f4006..838fa52f84 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -466,7 +466,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/pm/check-label-desc-cap.mjs',
-  'scripts/pm/check-skill-line-ratchet.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);
diff --git a/scripts/pm/check-skill-line-ratchet.mjs b/scripts/pm/check-skill-line-ratchet.mjs
index 909cf4cf82..ac29e415e7 100644
--- a/scripts/pm/check-skill-line-ratchet.mjs
+++ b/scripts/pm/check-skill-line-ratchet.mjs
@@ -76,6 +76,7 @@
 
 import { readFileSync } from 'node:fs';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = new URL('../../', import.meta.url);
 
@@ -272,5 +273,10 @@ function selfTest() {
   console.log(`✓ check-skill-line-ratchet self-test: ${cases.length} cases pass.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From e4c87954de937625f23277806168da78a5871b03 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:51:54 +0000
Subject: [PATCH 03/25] fix(scripts): guard check-label-desc-cap against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/pm/check-label-desc-cap.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 838fa52f84..ecd88fee92 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -465,7 +465,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/measure-test-shard-timings.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
-  'scripts/pm/check-label-desc-cap.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);
diff --git a/scripts/pm/check-label-desc-cap.mjs b/scripts/pm/check-label-desc-cap.mjs
index b83d6b158c..bb1cb8e7b3 100644
--- a/scripts/pm/check-label-desc-cap.mjs
+++ b/scripts/pm/check-label-desc-cap.mjs
@@ -83,6 +83,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = join(fileURLToPath(import.meta.url), '..', '..', '..');
 
@@ -477,5 +478,10 @@ function selfTest() {
   console.log('\n✓ check-label-desc-cap --self-test: all cases passed');
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From 87bda0fcf892172a8b116b44ecce33d985dade53 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:52:10 +0000
Subject: [PATCH 04/25] fix(scripts): guard ablation-dist-preflight against
 running on import

---
 scripts/ablation-dist-preflight.mjs | 8 +++++++-
 scripts/check-entry-guard.mjs       | 1 -
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/ablation-dist-preflight.mjs b/scripts/ablation-dist-preflight.mjs
index 17eed42b4e..ee1071562f 100644
--- a/scripts/ablation-dist-preflight.mjs
+++ b/scripts/ablation-dist-preflight.mjs
@@ -144,6 +144,7 @@ import { join, relative, resolve, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = resolve(fileURLToPath(import.meta.url), '..', '..');
 
@@ -394,5 +395,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else run(argv);
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index ecd88fee92..0134da889f 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -435,7 +435,6 @@ export function importUnsafeStatements(source) {
  * names itself, which is what stops this from rotting into an allowlist.
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
-  'scripts/ablation-dist-preflight.mjs',
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-driver-memory-census.mjs',

From 8374e87b14c906da066ad56a74b095e765ce0e12 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:52:33 +0000
Subject: [PATCH 05/25] fix(scripts): guard check-driver-memory-census against
 running on import

---
 scripts/check-driver-memory-census.mjs | 8 +++++++-
 scripts/check-entry-guard.mjs          | 1 -
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-driver-memory-census.mjs b/scripts/check-driver-memory-census.mjs
index 09a395f61d..22f1d37c1e 100644
--- a/scripts/check-driver-memory-census.mjs
+++ b/scripts/check-driver-memory-census.mjs
@@ -109,6 +109,7 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const LEDGER_PATH = join(ROOT, 'scripts', 'driver-memory-census.ledger.json');
@@ -683,5 +684,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else report({ list: argv.includes('--list') });
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 0134da889f..b0cb82abb5 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -437,7 +437,6 @@ export function importUnsafeStatements(source) {
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-dispatcher-error-vocabulary.mjs',
-  'scripts/check-driver-memory-census.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-code-casing.mjs',

From 3ba3d35611cede2d7032fa6ec4f3735420804373 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:53:31 +0000
Subject: [PATCH 06/25] fix(scripts): guard check-examples-live-imports against
 running on import

---
 scripts/check-entry-guard.mjs           | 1 -
 scripts/check-examples-live-imports.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index b0cb82abb5..b2e34952a2 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-examples-live-imports.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-nul-bytes.mjs',
   'scripts/check-org-identifier.mjs',
diff --git a/scripts/check-examples-live-imports.mjs b/scripts/check-examples-live-imports.mjs
index 6c7a579642..71800f3a17 100644
--- a/scripts/check-examples-live-imports.mjs
+++ b/scripts/check-examples-live-imports.mjs
@@ -122,6 +122,7 @@ import { globToRegExp } from './check-cross-package-test-inputs.mjs';
 import { join, resolve, relative, dirname, sep, posix } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -759,7 +760,12 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else if (argv.includes('--list')) list();
 else if (argv.includes('--json')) {
   const { rows, unresolved } = collect();

From bffe0b2caaf5d7083a15d119441c407ac4ad9ac7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:54:12 +0000
Subject: [PATCH 07/25] fix(scripts): guard check-nul-bytes against running on
 import

---
 scripts/check-entry-guard.mjs | 1 -
 scripts/check-nul-bytes.mjs   | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index b2e34952a2..1ddc7af728 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -442,7 +442,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
-  'scripts/check-nul-bytes.mjs',
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
diff --git a/scripts/check-nul-bytes.mjs b/scripts/check-nul-bytes.mjs
index 00d0c58c3e..944267042b 100644
--- a/scripts/check-nul-bytes.mjs
+++ b/scripts/check-nul-bytes.mjs
@@ -269,6 +269,7 @@ import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, w
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The scanned set as a 256-entry lookup: every ASCII control character except
@@ -1155,7 +1156,12 @@ function selfTest() {
   console.log(`✓ check-nul-bytes --self-test: ${checked} assertions over a temp git repo (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else if (process.argv.includes('--list')) {
   const result = scan(repoRoot());

From f3441d3e3bcdae0bd659039d60514f159fee0ea2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:54:30 +0000
Subject: [PATCH 08/25] fix(scripts): guard check-ratchet-remedy-authority
 against running on import

---
 scripts/check-entry-guard.mjs              | 1 -
 scripts/check-ratchet-remedy-authority.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 1ddc7af728..97fc65644a 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -445,7 +445,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
-  'scripts/check-ratchet-remedy-authority.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-required-contexts.mjs',
   'scripts/check-route-envelope.mjs',
diff --git a/scripts/check-ratchet-remedy-authority.mjs b/scripts/check-ratchet-remedy-authority.mjs
index 22deab58f2..e619d38bd7 100644
--- a/scripts/check-ratchet-remedy-authority.mjs
+++ b/scripts/check-ratchet-remedy-authority.mjs
@@ -107,6 +107,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -982,6 +983,11 @@ function selfTest() {
   process.exit(0);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else if (process.argv.includes('--list')) list();
 else main();

From 6d2c93138831a72122787e94615f73c654221b9f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:55:55 +0000
Subject: [PATCH 09/25] fix(scripts): guard check-required-contexts against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-required-contexts.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 97fc65644a..f55a7dbd0d 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-required-contexts.mjs',
   'scripts/check-route-envelope.mjs',
   'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
diff --git a/scripts/check-required-contexts.mjs b/scripts/check-required-contexts.mjs
index 387ede433a..222404ead5 100644
--- a/scripts/check-required-contexts.mjs
+++ b/scripts/check-required-contexts.mjs
@@ -181,6 +181,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The branch-protection-required check contexts, as this repository declares
@@ -2266,7 +2267,12 @@ async function selfTest() {
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   await selfTest();
 } else if (process.argv.includes('--verify-required-set')) {
   // Report-only, off the required path (#9642). Exit 0 = swept (0 or N

From 94b8037d757cffb510df76e2f98175d99b487df0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:56:23 +0000
Subject: [PATCH 10/25] fix(scripts): guard check-route-envelope against
 running on import

---
 scripts/check-entry-guard.mjs    | 1 -
 scripts/check-route-envelope.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index f55a7dbd0d..1d1be13a6b 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-route-envelope.mjs',
   'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
diff --git a/scripts/check-route-envelope.mjs b/scripts/check-route-envelope.mjs
index a4c76d7a6a..a0f936cec2 100644
--- a/scripts/check-route-envelope.mjs
+++ b/scripts/check-route-envelope.mjs
@@ -144,6 +144,7 @@ import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -2582,5 +2583,10 @@ function selfTest() {
   console.log('✓ check-route-envelope self-test passed');
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else audit();

From 0374bb3b564f6683887192add396351ed8f8dab9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:56:40 +0000
Subject: [PATCH 11/25] fix(scripts): guard check-runtime-services-index
 against running on import

---
 scripts/check-entry-guard.mjs            | 1 -
 scripts/check-runtime-services-index.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 1d1be13a6b..48bc33f8f4 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
diff --git a/scripts/check-runtime-services-index.mjs b/scripts/check-runtime-services-index.mjs
index 00e6f2d46e..3c0118964b 100644
--- a/scripts/check-runtime-services-index.mjs
+++ b/scripts/check-runtime-services-index.mjs
@@ -229,6 +229,7 @@ import { readFileSync, readdirSync, statSync, existsSync, mkdtempSync, mkdirSync
 import { join, dirname, relative, sep } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const repoRoot = () => join(HERE, '..');
@@ -1064,5 +1065,10 @@ function selfTest() {
   console.log(`✓ check-runtime-services-index --self-test: ${checked} assertions over a temp fixture (real run() path); every limb -- chapter list, kernel table, meta.json, order, href, title premise, registry slot (incl. the split-line registration), stability matrix (missing row, stale row, order) and stability LABEL on both tables, canonical-source rows (page-less row, page with no row, prose label, duplicate, missing path, and never read as a stability claim), label VOCABULARY (undefined label named with its allowed set and reported only against the page, every defined label accepted, the two legends drifting apart from EACH OTHER while every label they name is still in the enum, a legend widening it alone, legend order, section scoping past a decoy in each file, and a missing legend refused), empty tree, missing versioning.mdx, empty Source-of-Truth list -- observed FAILING and observed silent.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else main();

From 2d31e3527cbe22eb24e1ac3df241ec1b6b9b2fd7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:06 +0000
Subject: [PATCH 12/25] fix(scripts): guard check-shard-attestation against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-shard-attestation.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 48bc33f8f4..707f849cd5 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
diff --git a/scripts/check-shard-attestation.mjs b/scripts/check-shard-attestation.mjs
index 0d47264143..ebe8e2ae48 100644
--- a/scripts/check-shard-attestation.mjs
+++ b/scripts/check-shard-attestation.mjs
@@ -122,6 +122,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /** Artifact-name prefix shared by every shard credential. */
 const ARTIFACT_PREFIX = 'shard-attest-';
@@ -948,7 +949,12 @@ async function selfTest() {
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   await selfTest();
 } else if (process.argv.includes('--emit')) {
   emit();

From 0c9ad540f9ece100f19509e70cab4ace49590def Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:22 +0000
Subject: [PATCH 13/25] fix(scripts): guard check-spec-parsed-alias against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-spec-parsed-alias.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 707f849cd5..8287b81dd1 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
diff --git a/scripts/check-spec-parsed-alias.mjs b/scripts/check-spec-parsed-alias.mjs
index ade025dfee..aa9895fa3a 100644
--- a/scripts/check-spec-parsed-alias.mjs
+++ b/scripts/check-spec-parsed-alias.mjs
@@ -94,6 +94,7 @@
 
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SPEC_SRC = join(ROOT, 'packages/spec/src');
@@ -461,7 +462,12 @@ export type Iso0 = Assert<Eq< z.input< typeof M0.ColourSchema >, z.infer< typeof
   console.log('check-spec-parsed-alias --self-test: 18 assertions passed');
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else {
   const pins = readIsomorphicPins(readFileSync(PIN_FILE, 'utf8'));

From 536fcffcd74a77e525f052693901ab695bdd8559 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:51 +0000
Subject: [PATCH 14/25] fix(scripts): guard check-startup-registry-verdict
 against running on import

---
 scripts/check-entry-guard.mjs              | 1 -
 scripts/check-startup-registry-verdict.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 8287b81dd1..45d4f22af6 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
   'scripts/check-workflow-status-functions.mjs',
diff --git a/scripts/check-startup-registry-verdict.mjs b/scripts/check-startup-registry-verdict.mjs
index 90920ccab5..d5e4f98f11 100644
--- a/scripts/check-startup-registry-verdict.mjs
+++ b/scripts/check-startup-registry-verdict.mjs
@@ -150,6 +150,7 @@ import { join, relative, sep, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
 const BASELINE_PATH = join(ROOT, 'scripts', 'startup-registry-verdict.baseline.json');
@@ -1436,7 +1437,12 @@ function selfTest() {
 }
 
 const args = process.argv.slice(2);
-if (args.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (args.includes('--self-test')) {
     process.exit(selfTest());
 } else {
     const dirFlag = args.indexOf('--packages-dir');

From f2130938424b2e144fdcf8c2c76937e007e08bc1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:58:09 +0000
Subject: [PATCH 15/25] fix(scripts): guard check-workflow-status-functions
 against running on import

---
 scripts/check-entry-guard.mjs               | 1 -
 scripts/check-workflow-status-functions.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 45d4f22af6..5713ab8a75 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -448,7 +448,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
-  'scripts/check-workflow-status-functions.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/measure-test-shard-timings.mjs',
diff --git a/scripts/check-workflow-status-functions.mjs b/scripts/check-workflow-status-functions.mjs
index 51ed8b373c..bfc8900682 100644
--- a/scripts/check-workflow-status-functions.mjs
+++ b/scripts/check-workflow-status-functions.mjs
@@ -76,6 +76,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { LineCounter, isMap, isScalar, parseDocument } from 'yaml';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const WORKFLOW_DIR = '.github/workflows';
 
@@ -600,7 +601,12 @@ jobs:
   console.log(`✓ check-workflow-status-functions --self-test: ${checked} assertions over temp fixture roots (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else if (process.argv.includes('--list')) {
   list();

From b76daf6e8986a04225ae06995fef8f0ca8def2fc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:58:52 +0000
Subject: [PATCH 16/25] fix(scripts): guard check-error-code-casing against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-error-code-casing.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 5713ab8a75..41ce542d58 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -439,7 +439,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
-  'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',
diff --git a/scripts/check-error-code-casing.mjs b/scripts/check-error-code-casing.mjs
index 142e465d9c..2948a21c84 100644
--- a/scripts/check-error-code-casing.mjs
+++ b/scripts/check-error-code-casing.mjs
@@ -53,6 +53,7 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, sep } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SCAN_ROOTS = ['packages'];
@@ -241,4 +242,7 @@ If this literal is NOT an error.code — a field/param-addressed validator code
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 41e57b9029714824f51266ceb2178d7cfcf7d992 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:59:17 +0000
Subject: [PATCH 17/25] fix(scripts): guard check-dispatcher-error-vocabulary
 against running on import

---
 scripts/check-dispatcher-error-vocabulary.mjs | 6 +++++-
 scripts/check-entry-guard.mjs                 | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-dispatcher-error-vocabulary.mjs b/scripts/check-dispatcher-error-vocabulary.mjs
index 747369e3b3..caa28de2dc 100644
--- a/scripts/check-dispatcher-error-vocabulary.mjs
+++ b/scripts/check-dispatcher-error-vocabulary.mjs
@@ -152,6 +152,7 @@
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, dirname, resolve } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = resolve(new URL('..', import.meta.url).pathname);
 const SCAN_ROOT = 'packages';
@@ -1826,4 +1827,7 @@ function main() {
   console.log(bounds);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 41ce542d58..63de568961 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -436,7 +436,6 @@ export function importUnsafeStatements(source) {
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
-  'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-status-conformance.mjs',

From 544f7bd865536b7f3509954ad49eff9b04886922 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:59:43 +0000
Subject: [PATCH 18/25] fix(scripts): guard check-engine-split-ratio against
 running on import

---
 scripts/check-engine-split-ratio.mjs | 6 +++++-
 scripts/check-entry-guard.mjs        | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-engine-split-ratio.mjs b/scripts/check-engine-split-ratio.mjs
index cc4c243e43..c41da1f50c 100644
--- a/scripts/check-engine-split-ratio.mjs
+++ b/scripts/check-engine-split-ratio.mjs
@@ -74,6 +74,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { historyHorizon } from './pm/git-history.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -334,4 +335,7 @@ function selfTest() {
   return failures === 0 ? 0 : 1;
 }
 
-process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+}
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 63de568961..3ae2700941 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -437,7 +437,6 @@ export function importUnsafeStatements(source) {
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
-  'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',

From 196cb3f7d200a8123d02ba5c16ad5b28e94e371d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:00:05 +0000
Subject: [PATCH 19/25] fix(scripts): guard check-filter-alias-parity against
 running on import

---
 scripts/check-entry-guard.mjs         | 1 -
 scripts/check-filter-alias-parity.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 3ae2700941..2bd57e4bfb 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -438,7 +438,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
diff --git a/scripts/check-filter-alias-parity.mjs b/scripts/check-filter-alias-parity.mjs
index d0747301c9..d92a734e81 100644
--- a/scripts/check-filter-alias-parity.mjs
+++ b/scripts/check-filter-alias-parity.mjs
@@ -88,6 +88,7 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -648,4 +649,7 @@ function main() {
     process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 63f5016642089e519c9e05a8bc9aa5a888ac3421 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:00:50 +0000
Subject: [PATCH 20/25] fix(scripts): guard check-org-identifier against
 running on import

---
 scripts/check-entry-guard.mjs    | 1 -
 scripts/check-org-identifier.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 2bd57e4bfb..f48d85042c 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -438,7 +438,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
diff --git a/scripts/check-org-identifier.mjs b/scripts/check-org-identifier.mjs
index 438702306b..f54c84619a 100644
--- a/scripts/check-org-identifier.mjs
+++ b/scripts/check-org-identifier.mjs
@@ -271,6 +271,7 @@ import { join } from 'node:path';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
 import { maskComments } from './js-comment-mask.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOTS = ['examples', 'apps', 'packages'];
 const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.cts', '.mts'];
@@ -785,4 +786,7 @@ cheapest way to silence it while leaving the dead read in place.`);
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 0668e662e7a8439b4d63efa1c23dcd8fd711e1be Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:06 +0000
Subject: [PATCH 21/25] fix(scripts): guard check-quick-reference-counts
 against running on import

---
 scripts/check-entry-guard.mjs            | 1 -
 scripts/check-quick-reference-counts.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index f48d85042c..7453e4ea93 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -439,7 +439,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
-  'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
diff --git a/scripts/check-quick-reference-counts.mjs b/scripts/check-quick-reference-counts.mjs
index 6f7b632ead..e3ffc98a38 100644
--- a/scripts/check-quick-reference-counts.mjs
+++ b/scripts/check-quick-reference-counts.mjs
@@ -101,6 +101,7 @@
 
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const TARGET = 'content/docs/getting-started/quick-reference.mdx';
@@ -855,4 +856,7 @@ quietly stops recognising its page reports success forever.
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From e6b1b6b76e887bba5f4638b57e296c3a3c63fdd1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:23 +0000
Subject: [PATCH 22/25] fix(scripts): guard check-test-completeness against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-test-completeness.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 7453e4ea93..60bc7482ce 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
-  'scripts/check-test-completeness.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/measure-test-shard-timings.mjs',
diff --git a/scripts/check-test-completeness.mjs b/scripts/check-test-completeness.mjs
index 082f4523b1..707e5ad676 100644
--- a/scripts/check-test-completeness.mjs
+++ b/scripts/check-test-completeness.mjs
@@ -105,6 +105,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -905,4 +906,7 @@ silently did not run.`);
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 2a47d7ef252ca0d09edfd1c2aafb74134a096985 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:39 +0000
Subject: [PATCH 23/25] fix(scripts): guard measure-test-shard-timings against
 running on import

---
 scripts/check-entry-guard.mjs          | 1 -
 scripts/measure-test-shard-timings.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 60bc7482ce..950dba46b8 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -443,7 +443,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
-  'scripts/measure-test-shard-timings.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/qa/qa-rollup.mjs',
diff --git a/scripts/measure-test-shard-timings.mjs b/scripts/measure-test-shard-timings.mjs
index b909ec4d1c..924c32ed46 100644
--- a/scripts/measure-test-shard-timings.mjs
+++ b/scripts/measure-test-shard-timings.mjs
@@ -58,6 +58,7 @@ import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 
 import { countTestFiles } from './partition-test-shards.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const DEFAULT_OUT = path.join(REPO_ROOT, 'scripts', 'test-shard-timings.json');
@@ -382,4 +383,7 @@ function main() {
   );
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 46f58be4834b1f9b541f879479a5bb49ce2a6e7b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:03:25 +0000
Subject: [PATCH 24/25] fix(scripts): guard check-tenant-chokepoint against
 running on import

---
 scripts/check-entry-guard.mjs       |  1 -
 scripts/check-tenant-chokepoint.mjs | 10 ++++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 950dba46b8..85595ba2e9 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -440,7 +440,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-tenant-chokepoint.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/objectui-range.mjs',
diff --git a/scripts/check-tenant-chokepoint.mjs b/scripts/check-tenant-chokepoint.mjs
index 9ca7c69bd9..e1f5b1e6e0 100644
--- a/scripts/check-tenant-chokepoint.mjs
+++ b/scripts/check-tenant-chokepoint.mjs
@@ -112,6 +112,7 @@ import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -554,9 +555,14 @@ above catches it" is not one: this asserts the chokepoint's own contract.`);
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
   process.exit(0);
 }
 
-main();
+if (invokedDirectly) main();

From e1153da230117d424f8440b63845bd7d0f3e5aff Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:04:29 +0000
Subject: [PATCH 25/25] fix(scripts): guard check-audit-scope against running
 on import

---
 scripts/check-entry-guard.mjs            |  1 -
 scripts/docs-audit/check-audit-scope.mjs | 24 ++++++++++++++----------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 85595ba2e9..11e18e3f39 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/checklist-select.mjs',
-  'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/qa/qa-rollup.mjs',
diff --git a/scripts/docs-audit/check-audit-scope.mjs b/scripts/docs-audit/check-audit-scope.mjs
index 80d95eb743..d784b2dd6b 100644
--- a/scripts/docs-audit/check-audit-scope.mjs
+++ b/scripts/docs-audit/check-audit-scope.mjs
@@ -87,6 +87,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createContext, runInContext } from 'node:vm';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: HERE })
@@ -466,17 +467,20 @@ export async function checkReadOnlyRouting(source) {
 
 // --- main --------------------------------------------------------------------
 
-try {
-  if (args.includes('--self-test')) {
-    await selfTest();
-    process.exit(0);
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  try {
+    if (args.includes('--self-test')) {
+      await selfTest();
+      process.exit(0);
+    }
+    await main();
+  } catch (e) {
+    // A structural failure (markers gone, list unparseable, derivation empty) is
+    // a RED result with a readable reason — never a stack trace, never a pass.
+    console.error(`✗ ${e.message}`);
+    process.exit(1);
   }
-  await main();
-} catch (e) {
-  // A structural failure (markers gone, list unparseable, derivation empty) is a
-  // RED result with a readable reason — never a stack trace, and never a pass.
-  console.error(`✗ ${e.message}`);
-  process.exit(1);
 }
 
 async function main() {