fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0

scripts/check-changeset-no-major.mjs

@@ -354,6 +354,8 @@ import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { isEntrypoint } from './invoked-as.mjs';
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
 
@@ -1522,7 +1524,27 @@ function selfTest() {
 
 const argv = process.argv.slice(2);
 
-if (argv.includes('--self-test')) {
+/**
+ * The guard is INVERTED so the dispatch chain below keeps its indentation:
+ * the imported case is the empty first branch, and every mode that was here
+ * before is untouched in the `else if` chain.
+ *
+ * Measured before this landed: importing this module for its exports ran the
+ * whole gate inside the importer, and then `main()`'s trailing
+ * `process.exit(exitCode)` ended that process mid-import — carrying status 0.
+ * The importer never reached the statement after its own `import()`, and a
+ * caller reading the status alone cannot tell that apart from a clean import.
+ *
+ * Nothing imports this file today (every reference in `.github/**`,
+ * `package.json` and `scripts/**` spawns it as `node scripts/...`), so the
+ * guard silences no census: the only top-level statement it moves behind
+ * `isEntrypoint` is CLI dispatch.
+ */
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) {
   if (selfTest() !== SELF_TEST_VERDICT) {
       console.error(
           '\n✗ check-changeset-no-major self-test: selfTest() returned without reaching its verdict,\n'

scripts/check-empty-changeset.mjs

@@ -143,6 +143,8 @@ import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { isEntrypoint } from './invoked-as.mjs';
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
 
@@ -1445,7 +1447,26 @@ function selfTest() {
 
 const argv = process.argv.slice(2);
 
-if (argv.includes('--self-test')) {
+/**
+ * The guard is INVERTED so the dispatch chain below keeps its indentation:
+ * the imported case is the empty first branch, and every mode that was here
+ * before is untouched in the `else if` chain.
+ *
+ * Measured before this landed: importing this module for its exports ran the
+ * whole gate inside the importer and wrote this gate's verdict to the
+ * importer's stdout before the exports came back — foreign output in a tool
+ * that never asked for it.
+ *
+ * Nothing imports this file today (every reference in `.github/**`,
+ * `package.json` and `scripts/**` spawns it as `node scripts/...`), so the
+ * guard silences no census: the only top-level statement it moves behind
+ * `isEntrypoint` is CLI dispatch.
+ */
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) {
   if (selfTest() !== SELF_TEST_VERDICT) {
       console.error(
           '\n✗ check-empty-changeset self-test: selfTest() returned without reaching its verdict,\n'

scripts/check-entry-guard.mjs

@@ -457,10 +457,7 @@ export function importUnsafeStatements(source) {
  * a line in here. An entry whose file has since been fixed fails as STALE and
  * names itself, which is what stops this from rotting into an allowlist.
  */
-const KNOWN_IMPORT_UNSAFE = new Set([
-  'scripts/check-changeset-no-major.mjs',
-  'scripts/check-empty-changeset.mjs',
-]);
+const KNOWN_IMPORT_UNSAFE = new Set([]);
 
 /**
  * The SCAN SURFACE, written in the syntax `scripts/pm/dispatch-gates.mjs` can

scripts/pm/dispatch-gates.mjs

@@ -12150,20 +12150,34 @@ function selfTest() {
       JSON.stringify({ verdict: verdict?.verdict, hints: entry?.hints }),
     );
     // The ablation, run in-place: strip the declared SUBTREE from the live hint
-    // set and the verdict must fall back to what it was before this landed.
+    // set and the verdict must fall back to NOT MATCHED — that is the whole
+    // claim, since a brand-new file is nameable only through the subtree half.
     // Without it the case above could pass through any hint that happened to
     // cover the probe, and the reader could not tell which half was load-bearing.
+    //
+    // WHICH not-matched verdict it lands on is not fixed, and pinning one
+    // spelling was a latent trap: for `check:entry-guard` the residual depends
+    // on whether its KNOWN_IMPORT_UNSAFE roster still contributes path literals
+    // as hints — `silent` while it held entries, `undetermined` once it emptied
+    // and the stripped hint set is bare. That ledger is ⛔ SHRINK-ONLY and
+    // reaching zero is its GOAL, so the day it emptied this case went red over
+    // a gate that had not changed at all. Either verdict proves the subtree
+    // hint is the load-bearing half, so both are accepted — spelled as an
+    // explicit pair rather than `!== 'matched'`, so a NEW verdict value added
+    // later cannot slip through here as a pass.
     const undeclared = entry ? { ...entry, hints: entry.hints.filter((h) => !h.includes('/*')) } : null;
+    const residual = undeclared ? classifyEntry(undeclared, [unwrittenScript]).verdict : null;
     t(
-      `…and it is the subtree declaration doing it: strip it and ${gate} goes back to silent`,
+      `…and it is the subtree declaration doing it: strip it and ${gate} goes back to NOT MATCHED`,
       // The length check is what stops this passing VACUOUSLY. With no subtree
-      // hint to remove, `undeclared` is the entry itself and `silent === silent`
-      // reads as a pass — measured, on the ablation run that removed both
-      // declarations: this case stayed green while the two above went red.
+      // hint to remove, `undeclared` is the entry itself and a not-matched
+      // verdict compared against itself reads as a pass — measured, on the
+      // ablation run that removed both declarations: this case stayed green
+      // while the two above went red.
       Boolean(undeclared) &&
         undeclared.hints.length < entry.hints.length &&
-        classifyEntry(undeclared, [unwrittenScript]).verdict === 'silent',
-      JSON.stringify({ before: entry?.hints?.length, after: undeclared?.hints?.length }),
+        ['silent', 'undetermined'].includes(residual),
+      JSON.stringify({ before: entry?.hints?.length, after: undeclared?.hints?.length, residual }),
     );
   }