fix(devx): burn the KNOWN_IMPORT_UNSAFE ledger 10 -> 5 — a main() for the five scripts/ modules that ran on import (#11917)

* fix(pm): make check-governed-prose.mjs inert on import, and drop its dead argv workaround

Its top level ran the whole gate and then called process.exit() — importing it
for its exported predicates terminated the importer mid-import, with exit 0. The
silent-success direction: a caller reading status got "clean" from a gate that
never reported.

The module-scope `process.argv` mutation that withheld `--self-test` from the
sibling import is deleted rather than preserved. check-governed-merges.mjs now
guards both of its module-scope triggers on isEntrypoint(import.meta.url) (main
at :1201, self-test at :1614), so the flag cannot reach either one on an import
path. Measured: importing it with `--self-test` planted in process.argv runs no
self-test, prints nothing, returns its 34 exports. The mutation was never free —
process.argv is process-global, so it edited the importer's argv too.

CLI byte-identical before/after on both paths (default and --self-test): stdout,
stderr and exit code all cmp-clean. Import probe with clean argv: sentinel only,
empty stderr, exit 0. check:entry-guard named the file STALE before its ledger
line was removed; ledger 10 -> 9, gate green.

* fix(devx): give checklist-select.mjs a main(), so importing selectItems does not kill the importer

This one was the fatal shape in the ledger. Its top-level CLI ran on import:
importing it for `selectItems` — the pure resolver the checklist-test skill's
front half is built on — printed a usage block to the importer's stderr and
called process.exit(2) mid-import. The probe's own sentinel never printed.

The self-test block becomes selfTest(), the CLI block becomes main(), and both
run only under isEntrypoint(import.meta.url). No executable line changed other
than its enclosing scope; the process.exit() calls stay exactly where they were.

Verified byte-for-byte against the pristine base tree, since a main() extraction
moves executable lines where a wrap does not — stdout, stderr and exit code all
cmp-clean on six legs: default (usage, exit 2), --self-test, `all --json`,
`area:approvals`, `all --include-blocked`, and `nope.xxx` (the no-match exit-1
path). Import probe with clean argv: sentinel only, empty stderr, exit 0.
check:entry-guard named it STALE before its ledger line went; ledger 9 -> 8.

* fix(devx): give check-release-page-status.mjs a main() so its verdict stops running inside importers

The file exports eleven predicates, and check-release-section-coverage.mjs is a
real reader of that surface — it inherits this gate's scope floor and pins the
two equal in its own self-test. Unguarded, importing any one of those predicates
ran the entire release-page gate and printed its verdict, so a caller's output
carried another gate's OK line above its own.

The run block becomes main(); it and the self-test dispatch now sit behind
isEntrypoint(import.meta.url).

Byte-for-byte against the pristine base tree on both paths, plus both paths of
check-release-section-coverage.mjs — the sibling that reads this module — all
cmp-clean on stdout, stderr and exit code. Import probe with clean argv: sentinel
only, empty stderr, exit 0. check:entry-guard named it STALE first; ledger 8 -> 7.

* fix(devx): give check-error-status-conformance.mjs a main() instead of running the derivation on import

The module exports the whole derivation — parseStandardErrorCodes,
buildConstantIndex, deriveRuntimeStatuses, deriveDoorMap, reconcile and the
message builders. Unguarded, importing any one of them walked the scan root,
read every non-test source file under it and printed this gate's full report
into the importer's stdout before the import returned. Measured on this tree:
the probe's own sentinel printed only after ~8s of another gate's output.

`walk` stays a module-scope function declaration — a declaration is not a side
effect, and the entry-guard rule does not reach one. Everything from
`const update` down becomes main(), behind isEntrypoint(import.meta.url).

Byte-for-byte against the pristine base tree on every code path this file has:
default, --self-test, --report, and --update — for --update, the rewritten
baseline artifact is byte-identical too, not just the stdout. All four legs
cmp-clean on stdout, stderr and exit code. Import probe with clean argv:
sentinel only, empty stderr, exit 0. STALE first; ledger 7 -> 6.

* fix(devx): stop check-query-options-erasure-ratchet.mjs re-execing its importer

The loudest entry in the ledger. Two separate import side effects, fixed two
different ways:

- `ensureStackHeadroom()` at module scope. It re-execs with --stack-size and
  then calls process.exit(status), so importing this module REPLACED the
  importer's process with a fresh run of this gate. Guarded IN PLACE rather
  than moved into main(): its docblock's invariant is an ordering one ("re-exec
  once, before any linting -- including before --self-test"), and leaving the
  call at its original position in module order is what keeps that ordering
  checkable by reading rather than by re-deriving it.
- The tail becomes async main(), with the self-test dispatch, behind the guard.

No module-scope declaration between the two constructs an ESLint instance (all
three `new ESLint` sites are inside functions), so nothing heavy moved across
the re-exec point.

checkHeadroomAdoption() still reads this gate as armed: it tests
/ensureStackHeadroom\s*\(/ over comment-stripped source, which an indented call
satisfies.

CLI byte-identical before/after on both paths — stdout, stderr and exit code —
captured through scripts/pm/os-verify-lock.sh. Import probe with clean argv now
returns in 0.5s with the sentinel only and empty stderr, where before it never
returned at all. STALE first; ledger 6 -> 5.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

scripts/check-entry-guard.mjs

@@ -460,12 +460,7 @@ export function importUnsafeStatements(source) {
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
-  'scripts/check-error-status-conformance.mjs',
-  'scripts/check-query-options-erasure-ratchet.mjs',
-  'scripts/check-release-page-status.mjs',
-  'scripts/checklist-select.mjs',
   'scripts/objectui-range.mjs',
-  'scripts/pm/check-governed-prose.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);

scripts/check-error-status-conformance.mjs

@@ -112,6 +112,7 @@
 import { readdirSync, readFileSync, writeFileSync, statSync, existsSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const SCAN_ROOT = 'packages';
 const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', '.turbo', 'coverage', 'build', 'fixtures']);
@@ -1083,7 +1084,6 @@ function selfTest() {
   process.exit(0);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
 
 // ───────────────────────────────────────────────────────────────────────────
 // The real check
@@ -1099,134 +1099,145 @@ function walk(dir, out) {
   }
 }
 
-const update = process.argv.includes('--update');
-
-const files = [];
-walk(SCAN_ROOT, files);
-const sources = new Map();
-for (const f of files.sort()) sources.set(relative('.', f).replace(/\\/g, '/'), readFileSync(f, 'utf8'));
-
-const errorsZod = readFileSync(ERRORS_ZOD, 'utf8');
-const members = parseStandardErrorCodes(errorsZod);
-const index = buildConstantIndex(sources);
-const derived = deriveRuntimeStatuses(sources, index);
-for (const { code, status } of deriveDoorMap(errorsZod)) {
-  if (!derived.emitted.has(code)) derived.emitted.set(code, new Map());
-  const perStatus = derived.emitted.get(code);
-  if (!perStatus.has(status)) perStatus.set(status, []);
-  if (!perStatus.get(status).includes(`${ERRORS_ZOD}: HttpStatusErrorCodeMap`)) {
-    perStatus.get(status).push(`${ERRORS_ZOD}: HttpStatusErrorCodeMap`);
+function main() {
+  const update = process.argv.includes('--update');
+
+  const files = [];
+  walk(SCAN_ROOT, files);
+  const sources = new Map();
+  for (const f of files.sort()) sources.set(relative('.', f).replace(/\\/g, '/'), readFileSync(f, 'utf8'));
+
+  const errorsZod = readFileSync(ERRORS_ZOD, 'utf8');
+  const members = parseStandardErrorCodes(errorsZod);
+  const index = buildConstantIndex(sources);
+  const derived = deriveRuntimeStatuses(sources, index);
+  for (const { code, status } of deriveDoorMap(errorsZod)) {
+    if (!derived.emitted.has(code)) derived.emitted.set(code, new Map());
+    const perStatus = derived.emitted.get(code);
+    if (!perStatus.has(status)) perStatus.set(status, []);
+    if (!perStatus.get(status).includes(`${ERRORS_ZOD}: HttpStatusErrorCodeMap`)) {
+      perStatus.get(status).push(`${ERRORS_ZOD}: HttpStatusErrorCodeMap`);
+    }
   }
-}
 
-const doc = parseDocumentedStatuses({
-  handling: readFileSync(DOC_HANDLING, 'utf8'),
-  catalog: readFileSync(DOC_CATALOG, 'utf8'),
-});
-const { vocabulary, docPublishedBeyondStandard } = reconciledVocabulary({ members, ...doc });
-const result = reconcile({ vocabulary, emitted: derived.emitted, ...doc });
-
-const baseline = existsSync(BASELINE_PATH)
-  ? JSON.parse(readFileSync(BASELINE_PATH, 'utf8'))
-  : { unpinned: [] };
-const baselined = new Set(baseline.unpinned ?? []);
-const newlyUnpinned = result.unpinned.filter((c) => !baselined.has(c));
-const nowPinnedFindings = nowPinned({
-  baselined: [...baselined], unpinned: result.unpinned, vocabulary, documented: doc.documented,
-});
-
-if (update) {
-  writeFileSync(
-    BASELINE_PATH,
-    `${JSON.stringify({
-      note:
-        'StandardErrorCode members documented with an HTTP status that NO producer this gate can read '
-        + 'declares a status for — nothing pins the doc claim on either side. Shrink-only: a new entry is a '
-        + 'gate failure, and a row that becomes pinned must be removed. Regenerate with '
-        + '`node scripts/check-error-status-conformance.mjs --update`.',
-      unpinned: result.unpinned,
-    }, null, 2)}\n`,
-  );
-  console.log(`Baseline rewritten: ${result.unpinned.length} unpinned code(s).`);
-  process.exit(0);
-}
+  const doc = parseDocumentedStatuses({
+    handling: readFileSync(DOC_HANDLING, 'utf8'),
+    catalog: readFileSync(DOC_CATALOG, 'utf8'),
+  });
+  const { vocabulary, docPublishedBeyondStandard } = reconciledVocabulary({ members, ...doc });
+  const result = reconcile({ vocabulary, emitted: derived.emitted, ...doc });
 
-// The residual, as a SUBTRACTION from what the pages publish rather than a
-// claim about it: codes the deriver found that are neither a `StandardErrorCode`
-// member nor published with a status by a scanned page. Nothing here is a
-// literal, so registering a ledger code moves no number that has to be edited.
-const unreconciledLedger = [...derived.emitted.keys()].filter((c) => !vocabulary.includes(c)).sort();
-
-// `--report` prints the whole derivation rather than only the disagreements.
-// A finding is only as trustworthy as the evidence behind it, and "which
-// producers did you actually see for this code?" is the first question anyone
-// reading a failure asks.
-if (process.argv.includes('--report')) {
-  for (const code of vocabulary) {
-    const runtime = derived.emitted.get(code);
-    if (!runtime) continue;
-    console.log(`${code}`);
-    for (const [status, where] of [...runtime].sort((a, b) => a[0] - b[0])) {
-      console.log(`    ${status}  ${where.join('\n          ')}`);
+  const baseline = existsSync(BASELINE_PATH)
+    ? JSON.parse(readFileSync(BASELINE_PATH, 'utf8'))
+    : { unpinned: [] };
+  const baselined = new Set(baseline.unpinned ?? []);
+  const newlyUnpinned = result.unpinned.filter((c) => !baselined.has(c));
+  const nowPinnedFindings = nowPinned({
+    baselined: [...baselined], unpinned: result.unpinned, vocabulary, documented: doc.documented,
+  });
+
+  if (update) {
+    writeFileSync(
+      BASELINE_PATH,
+      `${JSON.stringify({
+        note:
+          'StandardErrorCode members documented with an HTTP status that NO producer this gate can read '
+          + 'declares a status for — nothing pins the doc claim on either side. Shrink-only: a new entry is a '
+          + 'gate failure, and a row that becomes pinned must be removed. Regenerate with '
+          + '`node scripts/check-error-status-conformance.mjs --update`.',
+        unpinned: result.unpinned,
+      }, null, 2)}\n`,
+    );
+    console.log(`Baseline rewritten: ${result.unpinned.length} unpinned code(s).`);
+    process.exit(0);
+  }
+
+  // The residual, as a SUBTRACTION from what the pages publish rather than a
+  // claim about it: codes the deriver found that are neither a `StandardErrorCode`
+  // member nor published with a status by a scanned page. Nothing here is a
+  // literal, so registering a ledger code moves no number that has to be edited.
+  const unreconciledLedger = [...derived.emitted.keys()].filter((c) => !vocabulary.includes(c)).sort();
+
+  // `--report` prints the whole derivation rather than only the disagreements.
+  // A finding is only as trustworthy as the evidence behind it, and "which
+  // producers did you actually see for this code?" is the first question anyone
+  // reading a failure asks.
+  if (process.argv.includes('--report')) {
+    for (const code of vocabulary) {
+      const runtime = derived.emitted.get(code);
+      if (!runtime) continue;
+      console.log(`${code}`);
+      for (const [status, where] of [...runtime].sort((a, b) => a[0] - b[0])) {
+        console.log(`    ${status}  ${where.join('\n          ')}`);
+      }
     }
+    console.log(`\nderived but NOT reconciled — no scanned page publishes a status for these ${unreconciledLedger.length}:`);
+    for (const c of unreconciledLedger) console.log(`    ${c}`);
   }
-  console.log(`\nderived but NOT reconciled — no scanned page publishes a status for these ${unreconciledLedger.length}:`);
-  for (const c of unreconciledLedger) console.log(`    ${c}`);
-}
 
-console.log('check:error-status-conformance — documented HTTP status ⇄ runtime-emitted status');
-console.log(
-  `  scope: ${vocabulary.length} code(s) reconciled = ${members.length} StandardErrorCode member(s) `
-  + `+ ${docPublishedBeyondStandard.length} ledger code(s) a doc page publishes a status for`
-  + `${docPublishedBeyondStandard.length ? ` (${docPublishedBeyondStandard.join(', ')})` : ''}; `
-  + `${sources.size} source files scanned; ${derived.sites} producer site(s) derived; `
-  + `${unreconciledLedger.length} further ledger code(s) derived but NOT reconciled — no scanned page publishes `
-  + 'a status for them, so there is nothing to reconcile them against.',
-);
-console.log(
-  `  reconciled: ${result.reconciledCodes} code(s) with a derived producer, `
-  + `${result.reconciledPairs} (code, status) pair(s) matched against the docs.`,
-);
-console.log(`  unpinned: ${result.unpinned.length} documented code(s) with no derivable producer (baselined: ${baselined.size}).`);
-const ungraded = ungradedEntries(doc);
-if (ungraded.length) {
+  console.log('check:error-status-conformance — documented HTTP status ⇄ runtime-emitted status');
   console.log(
-    `  ungraded: ${ungraded.length} doc entr(y|ies) whose heading was read but for which no page publishes a `
-    + 'status in a graded shape (reported, not failed — see `ungradedEntries`) —',
+    `  scope: ${vocabulary.length} code(s) reconciled = ${members.length} StandardErrorCode member(s) `
+    + `+ ${docPublishedBeyondStandard.length} ledger code(s) a doc page publishes a status for`
+    + `${docPublishedBeyondStandard.length ? ` (${docPublishedBeyondStandard.join(', ')})` : ''}; `
+    + `${sources.size} source files scanned; ${derived.sites} producer site(s) derived; `
+    + `${unreconciledLedger.length} further ledger code(s) derived but NOT reconciled — no scanned page publishes `
+    + 'a status for them, so there is nothing to reconcile them against.',
   );
-  for (const e of ungraded) console.log(`      ${e.code}  ${e.where}`);
-}
-if (doc.unreadableHeadings.length) {
-  console.log(`  unreadable: ${doc.unreadableHeadings.length} doc heading(s) naming a code in an unrecognised shape —`);
-  for (const u of doc.unreadableHeadings) console.log(`      ${u.path}:${u.line} ${JSON.stringify(u.text)}`);
-}
-if (derived.unresolved.length) {
-  console.log(`  unresolved: ${derived.unresolved.length} declaration(s) the deriver could not read —`);
-  for (const u of derived.unresolved) console.log(`      ${u}`);
-}
-
-if (result.reconciledPairs === 0) {
-  console.error(
-    '\n✗ the deriver matched ZERO (code, status) pairs. A green run with nothing reconciled is a blind run, '
-    + 'not a clean one — the source anchors this gate reads have moved.\n',
+  console.log(
+    `  reconciled: ${result.reconciledCodes} code(s) with a derived producer, `
+    + `${result.reconciledPairs} (code, status) pair(s) matched against the docs.`,
   );
-  process.exit(1);
-}
+  console.log(`  unpinned: ${result.unpinned.length} documented code(s) with no derivable producer (baselined: ${baselined.size}).`);
+  const ungraded = ungradedEntries(doc);
+  if (ungraded.length) {
+    console.log(
+      `  ungraded: ${ungraded.length} doc entr(y|ies) whose heading was read but for which no page publishes a `
+      + 'status in a graded shape (reported, not failed — see `ungradedEntries`) —',
+    );
+    for (const e of ungraded) console.log(`      ${e.code}  ${e.where}`);
+  }
+  if (doc.unreadableHeadings.length) {
+    console.log(`  unreadable: ${doc.unreadableHeadings.length} doc heading(s) naming a code in an unrecognised shape —`);
+    for (const u of doc.unreadableHeadings) console.log(`      ${u.path}:${u.line} ${JSON.stringify(u.text)}`);
+  }
+  if (derived.unresolved.length) {
+    console.log(`  unresolved: ${derived.unresolved.length} declaration(s) the deriver could not read —`);
+    for (const u of derived.unresolved) console.log(`      ${u}`);
+  }
 
-const failures = [];
-for (const f of result.emittedNotDocumented) failures.push(emittedNotDocumentedMessage(f));
-for (const f of result.documentedNotReachable) failures.push(documentedNotReachableMessage(f));
-for (const u of doc.unreadableHeadings) failures.push(unreadableHeadingMessage(u));
-for (const c of newlyUnpinned) failures.push(newUnpinnedMessage(c));
-for (const f of nowPinnedFindings) {
-  failures.push(f.reason === 'producer' ? nowPinnedProducerMessage(f.code) : nowPinnedDocRemovedMessage(f.code));
-}
+  if (result.reconciledPairs === 0) {
+    console.error(
+      '\n✗ the deriver matched ZERO (code, status) pairs. A green run with nothing reconciled is a blind run, '
+      + 'not a clean one — the source anchors this gate reads have moved.\n',
+    );
+    process.exit(1);
+  }
+
+  const failures = [];
+  for (const f of result.emittedNotDocumented) failures.push(emittedNotDocumentedMessage(f));
+  for (const f of result.documentedNotReachable) failures.push(documentedNotReachableMessage(f));
+  for (const u of doc.unreadableHeadings) failures.push(unreadableHeadingMessage(u));
+  for (const c of newlyUnpinned) failures.push(newUnpinnedMessage(c));
+  for (const f of nowPinnedFindings) {
+    failures.push(f.reason === 'producer' ? nowPinnedProducerMessage(f.code) : nowPinnedDocRemovedMessage(f.code));
+  }
 
-if (failures.length) {
-  console.error('');
-  for (const f of failures) console.error(`  ✗ ${f}`);
-  console.error(`\n✗ check:error-status-conformance — ${failures.length} finding(s).\n`);
-  process.exit(1);
+  if (failures.length) {
+    console.error('');
+    for (const f of failures) console.error(`  ✗ ${f}`);
+    console.error(`\n✗ check:error-status-conformance — ${failures.length} finding(s).\n`);
+    process.exit(1);
+  }
+
+  console.log('\n✓ every derivable runtime status is documented, and every documented status is reachable.');
 }
 
-console.log('\n✓ every derivable runtime status is documented, and every documented status is reachable.');
+// Guarded: this module exports the whole derivation (parseStandardErrorCodes,
+// deriveRuntimeStatuses, reconcile, and the message builders), and unguarded an
+// import of any of them walked the scan root, read every source file and printed
+// this gate's full report into the importer's stdout before returning a binding.
+if (isEntrypoint(import.meta.url)) {
+  if (process.argv.includes('--self-test')) selfTest();
+  main();
+}