From 128c73d1c077ca068c4fef58482cd9a9cbb844f6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:49:54 +0000
Subject: [PATCH 01/25] fix(scripts): guard check-skill-id-lint against running
 on import

---
 scripts/check-entry-guard.mjs      | 1 -
 scripts/pm/check-skill-id-lint.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 9275060393f..ddc92f4006e 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -466,7 +466,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/pm/check-label-desc-cap.mjs',
-  'scripts/pm/check-skill-id-lint.mjs',
   'scripts/pm/check-skill-line-ratchet.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
diff --git a/scripts/pm/check-skill-id-lint.mjs b/scripts/pm/check-skill-id-lint.mjs
index 1044b5356af..a00c6354f60 100644
--- a/scripts/pm/check-skill-id-lint.mjs
+++ b/scripts/pm/check-skill-id-lint.mjs
@@ -47,6 +47,7 @@ import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = join(fileURLToPath(import.meta.url), '..', '..', '..');
 
@@ -203,5 +204,10 @@ function selfTest() {
   console.log(`✓ check-skill-id-lint self-test: ${cases.length} cases pass.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From 76943111e8e503eff05240615492305b4b3bbc8b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:51:20 +0000
Subject: [PATCH 02/25] fix(scripts): guard check-skill-line-ratchet against
 running on import

---
 scripts/check-entry-guard.mjs           | 1 -
 scripts/pm/check-skill-line-ratchet.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index ddc92f4006e..838fa52f84f 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -466,7 +466,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/pm/check-label-desc-cap.mjs',
-  'scripts/pm/check-skill-line-ratchet.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);
diff --git a/scripts/pm/check-skill-line-ratchet.mjs b/scripts/pm/check-skill-line-ratchet.mjs
index 909cf4cf82a..ac29e415e7d 100644
--- a/scripts/pm/check-skill-line-ratchet.mjs
+++ b/scripts/pm/check-skill-line-ratchet.mjs
@@ -76,6 +76,7 @@
 
 import { readFileSync } from 'node:fs';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = new URL('../../', import.meta.url);
 
@@ -272,5 +273,10 @@ function selfTest() {
   console.log(`✓ check-skill-line-ratchet self-test: ${cases.length} cases pass.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From e4c87954de937625f23277806168da78a5871b03 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:51:54 +0000
Subject: [PATCH 03/25] fix(scripts): guard check-label-desc-cap against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/pm/check-label-desc-cap.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 838fa52f84f..ecd88fee922 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -465,7 +465,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/measure-test-shard-timings.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
-  'scripts/pm/check-label-desc-cap.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);
diff --git a/scripts/pm/check-label-desc-cap.mjs b/scripts/pm/check-label-desc-cap.mjs
index b83d6b158ce..bb1cb8e7b35 100644
--- a/scripts/pm/check-label-desc-cap.mjs
+++ b/scripts/pm/check-label-desc-cap.mjs
@@ -83,6 +83,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const REPO_ROOT = join(fileURLToPath(import.meta.url), '..', '..', '..');
 
@@ -477,5 +478,10 @@ function selfTest() {
   console.log('\n✓ check-label-desc-cap --self-test: all cases passed');
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else run();

From 87bda0fcf892172a8b116b44ecce33d985dade53 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:52:10 +0000
Subject: [PATCH 04/25] fix(scripts): guard ablation-dist-preflight against
 running on import

---
 scripts/ablation-dist-preflight.mjs | 8 +++++++-
 scripts/check-entry-guard.mjs       | 1 -
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/ablation-dist-preflight.mjs b/scripts/ablation-dist-preflight.mjs
index 17eed42b4e1..ee1071562f8 100644
--- a/scripts/ablation-dist-preflight.mjs
+++ b/scripts/ablation-dist-preflight.mjs
@@ -144,6 +144,7 @@ import { join, relative, resolve, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = resolve(fileURLToPath(import.meta.url), '..', '..');
 
@@ -394,5 +395,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else run(argv);
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index ecd88fee922..0134da889ff 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -435,7 +435,6 @@ export function importUnsafeStatements(source) {
  * names itself, which is what stops this from rotting into an allowlist.
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
-  'scripts/ablation-dist-preflight.mjs',
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-driver-memory-census.mjs',

From 8374e87b14c906da066ad56a74b095e765ce0e12 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:52:33 +0000
Subject: [PATCH 05/25] fix(scripts): guard check-driver-memory-census against
 running on import

---
 scripts/check-driver-memory-census.mjs | 8 +++++++-
 scripts/check-entry-guard.mjs          | 1 -
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-driver-memory-census.mjs b/scripts/check-driver-memory-census.mjs
index 09a395f61d3..22f1d37c1e5 100644
--- a/scripts/check-driver-memory-census.mjs
+++ b/scripts/check-driver-memory-census.mjs
@@ -109,6 +109,7 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const LEDGER_PATH = join(ROOT, 'scripts', 'driver-memory-census.ledger.json');
@@ -683,5 +684,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else report({ list: argv.includes('--list') });
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 0134da889ff..b0cb82abb55 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -437,7 +437,6 @@ export function importUnsafeStatements(source) {
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-dispatcher-error-vocabulary.mjs',
-  'scripts/check-driver-memory-census.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-code-casing.mjs',

From 3ba3d35611cede2d7032fa6ec4f3735420804373 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:53:31 +0000
Subject: [PATCH 06/25] fix(scripts): guard check-examples-live-imports against
 running on import

---
 scripts/check-entry-guard.mjs           | 1 -
 scripts/check-examples-live-imports.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index b0cb82abb55..b2e34952a2c 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-examples-live-imports.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-nul-bytes.mjs',
   'scripts/check-org-identifier.mjs',
diff --git a/scripts/check-examples-live-imports.mjs b/scripts/check-examples-live-imports.mjs
index 6c7a579642c..71800f3a17e 100644
--- a/scripts/check-examples-live-imports.mjs
+++ b/scripts/check-examples-live-imports.mjs
@@ -122,6 +122,7 @@ import { globToRegExp } from './check-cross-package-test-inputs.mjs';
 import { join, resolve, relative, dirname, sep, posix } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -759,7 +760,12 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else if (argv.includes('--list')) list();
 else if (argv.includes('--json')) {
   const { rows, unresolved } = collect();

From bffe0b2caaf5d7083a15d119441c407ac4ad9ac7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:54:12 +0000
Subject: [PATCH 07/25] fix(scripts): guard check-nul-bytes against running on
 import

---
 scripts/check-entry-guard.mjs | 1 -
 scripts/check-nul-bytes.mjs   | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index b2e34952a2c..1ddc7af7289 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -442,7 +442,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
-  'scripts/check-nul-bytes.mjs',
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
diff --git a/scripts/check-nul-bytes.mjs b/scripts/check-nul-bytes.mjs
index 00d0c58c3ed..944267042b6 100644
--- a/scripts/check-nul-bytes.mjs
+++ b/scripts/check-nul-bytes.mjs
@@ -269,6 +269,7 @@ import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, w
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The scanned set as a 256-entry lookup: every ASCII control character except
@@ -1155,7 +1156,12 @@ function selfTest() {
   console.log(`✓ check-nul-bytes --self-test: ${checked} assertions over a temp git repo (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else if (process.argv.includes('--list')) {
   const result = scan(repoRoot());

From f3441d3e3bcdae0bd659039d60514f159fee0ea2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:54:30 +0000
Subject: [PATCH 08/25] fix(scripts): guard check-ratchet-remedy-authority
 against running on import

---
 scripts/check-entry-guard.mjs              | 1 -
 scripts/check-ratchet-remedy-authority.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 1ddc7af7289..97fc65644a3 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -445,7 +445,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
-  'scripts/check-ratchet-remedy-authority.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-required-contexts.mjs',
   'scripts/check-route-envelope.mjs',
diff --git a/scripts/check-ratchet-remedy-authority.mjs b/scripts/check-ratchet-remedy-authority.mjs
index 22deab58f21..e619d38bd72 100644
--- a/scripts/check-ratchet-remedy-authority.mjs
+++ b/scripts/check-ratchet-remedy-authority.mjs
@@ -107,6 +107,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -982,6 +983,11 @@ function selfTest() {
   process.exit(0);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else if (process.argv.includes('--list')) list();
 else main();

From 6d2c93138831a72122787e94615f73c654221b9f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:55:55 +0000
Subject: [PATCH 09/25] fix(scripts): guard check-required-contexts against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-required-contexts.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 97fc65644a3..f55a7dbd0d3 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-required-contexts.mjs',
   'scripts/check-route-envelope.mjs',
   'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
diff --git a/scripts/check-required-contexts.mjs b/scripts/check-required-contexts.mjs
index 387ede433af..222404ead5c 100644
--- a/scripts/check-required-contexts.mjs
+++ b/scripts/check-required-contexts.mjs
@@ -181,6 +181,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The branch-protection-required check contexts, as this repository declares
@@ -2266,7 +2267,12 @@ async function selfTest() {
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   await selfTest();
 } else if (process.argv.includes('--verify-required-set')) {
   // Report-only, off the required path (#9642). Exit 0 = swept (0 or N

From 94b8037d757cffb510df76e2f98175d99b487df0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:56:23 +0000
Subject: [PATCH 10/25] fix(scripts): guard check-route-envelope against
 running on import

---
 scripts/check-entry-guard.mjs    | 1 -
 scripts/check-route-envelope.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index f55a7dbd0d3..1d1be13a6b2 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-route-envelope.mjs',
   'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
diff --git a/scripts/check-route-envelope.mjs b/scripts/check-route-envelope.mjs
index a4c76d7a6a0..a0f936cec28 100644
--- a/scripts/check-route-envelope.mjs
+++ b/scripts/check-route-envelope.mjs
@@ -144,6 +144,7 @@ import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -2582,5 +2583,10 @@ function selfTest() {
   console.log('✓ check-route-envelope self-test passed');
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else audit();

From 0374bb3b564f6683887192add396351ed8f8dab9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:56:40 +0000
Subject: [PATCH 11/25] fix(scripts): guard check-runtime-services-index
 against running on import

---
 scripts/check-entry-guard.mjs            | 1 -
 scripts/check-runtime-services-index.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 1d1be13a6b2..48bc33f8f45 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-runtime-services-index.mjs',
   'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
diff --git a/scripts/check-runtime-services-index.mjs b/scripts/check-runtime-services-index.mjs
index 00e6f2d46e7..3c0118964bb 100644
--- a/scripts/check-runtime-services-index.mjs
+++ b/scripts/check-runtime-services-index.mjs
@@ -229,6 +229,7 @@ import { readFileSync, readdirSync, statSync, existsSync, mkdtempSync, mkdirSync
 import { join, dirname, relative, sep } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const repoRoot = () => join(HERE, '..');
@@ -1064,5 +1065,10 @@ function selfTest() {
   console.log(`✓ check-runtime-services-index --self-test: ${checked} assertions over a temp fixture (real run() path); every limb -- chapter list, kernel table, meta.json, order, href, title premise, registry slot (incl. the split-line registration), stability matrix (missing row, stale row, order) and stability LABEL on both tables, canonical-source rows (page-less row, page with no row, prose label, duplicate, missing path, and never read as a stability claim), label VOCABULARY (undefined label named with its allowed set and reported only against the page, every defined label accepted, the two legends drifting apart from EACH OTHER while every label they name is still in the enum, a legend widening it alone, legend order, section scoping past a decoy in each file, and a missing legend refused), empty tree, missing versioning.mdx, empty Source-of-Truth list -- observed FAILING and observed silent.`);
 }
 
-if (process.argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) selfTest();
 else main();

From 2d31e3527cbe22eb24e1ac3df241ec1b6b9b2fd7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:06 +0000
Subject: [PATCH 12/25] fix(scripts): guard check-shard-attestation against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-shard-attestation.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 48bc33f8f45..707f849cd5d 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-shard-attestation.mjs',
   'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
diff --git a/scripts/check-shard-attestation.mjs b/scripts/check-shard-attestation.mjs
index 0d472641432..ebe8e2ae48c 100644
--- a/scripts/check-shard-attestation.mjs
+++ b/scripts/check-shard-attestation.mjs
@@ -122,6 +122,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /** Artifact-name prefix shared by every shard credential. */
 const ARTIFACT_PREFIX = 'shard-attest-';
@@ -948,7 +949,12 @@ async function selfTest() {
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   await selfTest();
 } else if (process.argv.includes('--emit')) {
   emit();

From 0c9ad540f9ece100f19509e70cab4ace49590def Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:22 +0000
Subject: [PATCH 13/25] fix(scripts): guard check-spec-parsed-alias against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-spec-parsed-alias.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 707f849cd5d..8287b81dd1e 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-spec-parsed-alias.mjs',
   'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
diff --git a/scripts/check-spec-parsed-alias.mjs b/scripts/check-spec-parsed-alias.mjs
index ade025dfee8..aa9895fa3af 100644
--- a/scripts/check-spec-parsed-alias.mjs
+++ b/scripts/check-spec-parsed-alias.mjs
@@ -94,6 +94,7 @@
 
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SPEC_SRC = join(ROOT, 'packages/spec/src');
@@ -461,7 +462,12 @@ export type Iso0 = Assert<Eq< z.input< typeof M0.ColourSchema >, z.infer< typeof
   console.log('check-spec-parsed-alias --self-test: 18 assertions passed');
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else {
   const pins = readIsomorphicPins(readFileSync(PIN_FILE, 'utf8'));

From 536fcffcd74a77e525f052693901ab695bdd8559 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:57:51 +0000
Subject: [PATCH 14/25] fix(scripts): guard check-startup-registry-verdict
 against running on import

---
 scripts/check-entry-guard.mjs              | 1 -
 scripts/check-startup-registry-verdict.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 8287b81dd1e..45d4f22af6e 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -446,7 +446,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-startup-registry-verdict.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
   'scripts/check-workflow-status-functions.mjs',
diff --git a/scripts/check-startup-registry-verdict.mjs b/scripts/check-startup-registry-verdict.mjs
index 90920ccab57..d5e4f98f11d 100644
--- a/scripts/check-startup-registry-verdict.mjs
+++ b/scripts/check-startup-registry-verdict.mjs
@@ -150,6 +150,7 @@ import { join, relative, sep, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
 const BASELINE_PATH = join(ROOT, 'scripts', 'startup-registry-verdict.baseline.json');
@@ -1436,7 +1437,12 @@ function selfTest() {
 }
 
 const args = process.argv.slice(2);
-if (args.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (args.includes('--self-test')) {
     process.exit(selfTest());
 } else {
     const dirFlag = args.indexOf('--packages-dir');

From f2130938424b2e144fdcf8c2c76937e007e08bc1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:58:09 +0000
Subject: [PATCH 15/25] fix(scripts): guard check-workflow-status-functions
 against running on import

---
 scripts/check-entry-guard.mjs               | 1 -
 scripts/check-workflow-status-functions.mjs | 8 +++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 45d4f22af6e..5713ab8a757 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -448,7 +448,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
-  'scripts/check-workflow-status-functions.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/measure-test-shard-timings.mjs',
diff --git a/scripts/check-workflow-status-functions.mjs b/scripts/check-workflow-status-functions.mjs
index 51ed8b373c9..bfc89006827 100644
--- a/scripts/check-workflow-status-functions.mjs
+++ b/scripts/check-workflow-status-functions.mjs
@@ -76,6 +76,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { LineCounter, isMap, isScalar, parseDocument } from 'yaml';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const WORKFLOW_DIR = '.github/workflows';
 
@@ -600,7 +601,12 @@ jobs:
   console.log(`✓ check-workflow-status-functions --self-test: ${checked} assertions over temp fixture roots (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else if (process.argv.includes('--list')) {
   list();

From b76daf6e8986a04225ae06995fef8f0ca8def2fc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:58:52 +0000
Subject: [PATCH 16/25] fix(scripts): guard check-error-code-casing against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-error-code-casing.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 5713ab8a757..41ce542d58e 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -439,7 +439,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
-  'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',
diff --git a/scripts/check-error-code-casing.mjs b/scripts/check-error-code-casing.mjs
index 142e465d9cc..2948a21c841 100644
--- a/scripts/check-error-code-casing.mjs
+++ b/scripts/check-error-code-casing.mjs
@@ -53,6 +53,7 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, sep } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SCAN_ROOTS = ['packages'];
@@ -241,4 +242,7 @@ If this literal is NOT an error.code — a field/param-addressed validator code
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 41e57b9029714824f51266ceb2178d7cfcf7d992 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:59:17 +0000
Subject: [PATCH 17/25] fix(scripts): guard check-dispatcher-error-vocabulary
 against running on import

---
 scripts/check-dispatcher-error-vocabulary.mjs | 6 +++++-
 scripts/check-entry-guard.mjs                 | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-dispatcher-error-vocabulary.mjs b/scripts/check-dispatcher-error-vocabulary.mjs
index 747369e3b3a..caa28de2dcf 100644
--- a/scripts/check-dispatcher-error-vocabulary.mjs
+++ b/scripts/check-dispatcher-error-vocabulary.mjs
@@ -152,6 +152,7 @@
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, dirname, resolve } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = resolve(new URL('..', import.meta.url).pathname);
 const SCAN_ROOT = 'packages';
@@ -1826,4 +1827,7 @@ function main() {
   console.log(bounds);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 41ce542d58e..63de5689618 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -436,7 +436,6 @@ export function importUnsafeStatements(source) {
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
-  'scripts/check-dispatcher-error-vocabulary.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-status-conformance.mjs',

From 544f7bd865536b7f3509954ad49eff9b04886922 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:59:43 +0000
Subject: [PATCH 18/25] fix(scripts): guard check-engine-split-ratio against
 running on import

---
 scripts/check-engine-split-ratio.mjs | 6 +++++-
 scripts/check-entry-guard.mjs        | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-engine-split-ratio.mjs b/scripts/check-engine-split-ratio.mjs
index cc4c243e437..c41da1f50cc 100644
--- a/scripts/check-engine-split-ratio.mjs
+++ b/scripts/check-engine-split-ratio.mjs
@@ -74,6 +74,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { historyHorizon } from './pm/git-history.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -334,4 +335,7 @@ function selfTest() {
   return failures === 0 ? 0 : 1;
 }
 
-process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+}
diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 63de5689618..3ae27009417 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -437,7 +437,6 @@ export function importUnsafeStatements(source) {
 const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
-  'scripts/check-engine-split-ratio.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',

From 196cb3f7d200a8123d02ba5c16ad5b28e94e371d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:00:05 +0000
Subject: [PATCH 19/25] fix(scripts): guard check-filter-alias-parity against
 running on import

---
 scripts/check-entry-guard.mjs         | 1 -
 scripts/check-filter-alias-parity.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 3ae27009417..2bd57e4bfb3 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -438,7 +438,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-filter-alias-parity.mjs',
   'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
diff --git a/scripts/check-filter-alias-parity.mjs b/scripts/check-filter-alias-parity.mjs
index d0747301c98..d92a734e81e 100644
--- a/scripts/check-filter-alias-parity.mjs
+++ b/scripts/check-filter-alias-parity.mjs
@@ -88,6 +88,7 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -648,4 +649,7 @@ function main() {
     process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 63f5016642089e519c9e05a8bc9aa5a888ac3421 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:00:50 +0000
Subject: [PATCH 20/25] fix(scripts): guard check-org-identifier against
 running on import

---
 scripts/check-entry-guard.mjs    | 1 -
 scripts/check-org-identifier.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 2bd57e4bfb3..f48d85042ce 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -438,7 +438,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-changeset-no-major.mjs',
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
diff --git a/scripts/check-org-identifier.mjs b/scripts/check-org-identifier.mjs
index 438702306b8..f54c84619ad 100644
--- a/scripts/check-org-identifier.mjs
+++ b/scripts/check-org-identifier.mjs
@@ -271,6 +271,7 @@ import { join } from 'node:path';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
 import { maskComments } from './js-comment-mask.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOTS = ['examples', 'apps', 'packages'];
 const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.cts', '.mts'];
@@ -785,4 +786,7 @@ cheapest way to silence it while leaving the dead read in place.`);
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 0668e662e7a8439b4d63efa1c23dcd8fd711e1be Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:06 +0000
Subject: [PATCH 21/25] fix(scripts): guard check-quick-reference-counts
 against running on import

---
 scripts/check-entry-guard.mjs            | 1 -
 scripts/check-quick-reference-counts.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index f48d85042ce..7453e4ea93d 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -439,7 +439,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-empty-changeset.mjs',
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
-  'scripts/check-quick-reference-counts.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/check-test-completeness.mjs',
diff --git a/scripts/check-quick-reference-counts.mjs b/scripts/check-quick-reference-counts.mjs
index 6f7b632eadb..e3ffc98a384 100644
--- a/scripts/check-quick-reference-counts.mjs
+++ b/scripts/check-quick-reference-counts.mjs
@@ -101,6 +101,7 @@
 
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const TARGET = 'content/docs/getting-started/quick-reference.mdx';
@@ -855,4 +856,7 @@ quietly stops recognising its page reports success forever.
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From e6b1b6b76e887bba5f4638b57e296c3a3c63fdd1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:23 +0000
Subject: [PATCH 22/25] fix(scripts): guard check-test-completeness against
 running on import

---
 scripts/check-entry-guard.mjs       | 1 -
 scripts/check-test-completeness.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 7453e4ea93d..60bc7482ce7 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/check-tenant-chokepoint.mjs',
-  'scripts/check-test-completeness.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/measure-test-shard-timings.mjs',
diff --git a/scripts/check-test-completeness.mjs b/scripts/check-test-completeness.mjs
index 082f4523b1a..707e5ad6764 100644
--- a/scripts/check-test-completeness.mjs
+++ b/scripts/check-test-completeness.mjs
@@ -105,6 +105,7 @@ import { readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -905,4 +906,7 @@ silently did not run.`);
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 2a47d7ef252ca0d09edfd1c2aafb74134a096985 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:01:39 +0000
Subject: [PATCH 23/25] fix(scripts): guard measure-test-shard-timings against
 running on import

---
 scripts/check-entry-guard.mjs          | 1 -
 scripts/measure-test-shard-timings.mjs | 6 +++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 60bc7482ce7..950dba46b84 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -443,7 +443,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-tenant-chokepoint.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
-  'scripts/measure-test-shard-timings.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/qa/qa-rollup.mjs',
diff --git a/scripts/measure-test-shard-timings.mjs b/scripts/measure-test-shard-timings.mjs
index b909ec4d1c4..924c32ed460 100644
--- a/scripts/measure-test-shard-timings.mjs
+++ b/scripts/measure-test-shard-timings.mjs
@@ -58,6 +58,7 @@ import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 
 import { countTestFiles } from './partition-test-shards.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const DEFAULT_OUT = path.join(REPO_ROOT, 'scripts', 'test-shard-timings.json');
@@ -382,4 +383,7 @@ function main() {
   );
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

From 46f58be4834b1f9b541f879479a5bb49ce2a6e7b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:03:25 +0000
Subject: [PATCH 24/25] fix(scripts): guard check-tenant-chokepoint against
 running on import

---
 scripts/check-entry-guard.mjs       |  1 -
 scripts/check-tenant-chokepoint.mjs | 10 ++++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 950dba46b84..85595ba2e91 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -440,7 +440,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-tenant-chokepoint.mjs',
   'scripts/checklist-select.mjs',
   'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/objectui-range.mjs',
diff --git a/scripts/check-tenant-chokepoint.mjs b/scripts/check-tenant-chokepoint.mjs
index 9ca7c69bd9d..e1f5b1e6e07 100644
--- a/scripts/check-tenant-chokepoint.mjs
+++ b/scripts/check-tenant-chokepoint.mjs
@@ -112,6 +112,7 @@ import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -554,9 +555,14 @@ above catches it" is not one: this asserts the chokepoint's own contract.`);
   );
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
   process.exit(0);
 }
 
-main();
+if (invokedDirectly) main();

From e1153da230117d424f8440b63845bd7d0f3e5aff Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 09:04:29 +0000
Subject: [PATCH 25/25] fix(scripts): guard check-audit-scope against running
 on import

---
 scripts/check-entry-guard.mjs            |  1 -
 scripts/docs-audit/check-audit-scope.mjs | 24 ++++++++++++++----------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/scripts/check-entry-guard.mjs b/scripts/check-entry-guard.mjs
index 85595ba2e91..11e18e3f392 100644
--- a/scripts/check-entry-guard.mjs
+++ b/scripts/check-entry-guard.mjs
@@ -441,7 +441,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
   'scripts/checklist-select.mjs',
-  'scripts/docs-audit/check-audit-scope.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
   'scripts/qa/qa-rollup.mjs',
diff --git a/scripts/docs-audit/check-audit-scope.mjs b/scripts/docs-audit/check-audit-scope.mjs
index 80d95eb7439..d784b2dd6b7 100644
--- a/scripts/docs-audit/check-audit-scope.mjs
+++ b/scripts/docs-audit/check-audit-scope.mjs
@@ -87,6 +87,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createContext, runInContext } from 'node:vm';
+import { isEntrypoint } from '../invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: HERE })
@@ -466,17 +467,20 @@ export async function checkReadOnlyRouting(source) {
 
 // --- main --------------------------------------------------------------------
 
-try {
-  if (args.includes('--self-test')) {
-    await selfTest();
-    process.exit(0);
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  try {
+    if (args.includes('--self-test')) {
+      await selfTest();
+      process.exit(0);
+    }
+    await main();
+  } catch (e) {
+    // A structural failure (markers gone, list unparseable, derivation empty) is
+    // a RED result with a readable reason — never a stack trace, never a pass.
+    console.error(`✗ ${e.message}`);
+    process.exit(1);
   }
-  await main();
-} catch (e) {
-  // A structural failure (markers gone, list unparseable, derivation empty) is a
-  // RED result with a readable reason — never a stack trace, and never a pass.
-  console.error(`✗ ${e.message}`);
-  process.exit(1);
 }
 
 async function main() {