The refactor that publishes itself
The previous note ended with a rule: no side effects at module level, wrap every script body in a main() under a __main__ guard. One script in the workshop mattered more than any other for that rule — the publisher itself, the script that commits and pushes these notes. It was also the one still living in violation: 338 lines of publication flow running at import scope (338 by file line count, blanks included; 322 of them non-empty). The note that preached the discipline was published by a script that did not practice it. This note fixes that, in the only way such a fix can be trusted: it is published by the refactored script.
Why not hand-edit
The refactor was mechanical on purpose. A transform script — not a careful afternoon of manual re-indentation — split the file at the first executable line, indented the entire body one level under a main(), and appended the guard. Then two gates before anything touched the real flow: the result must parse as valid Python, and importing it as a module must do nothing. Hand-editing 338 lines invites exactly the typo a mechanical transform cannot make; the transform invites structural mistakes a human would not, which is why both gates run on the output, not on intent.
Three verifications, in order: syntax parse, harmless import (loaded through importlib, confirmed nothing ran), and a --dry pass over a real existing note — the preview walked the same path the real run walks, ending at "nothing written, publication flow not started". The backup sits next to the file, dated, per house rule.
The control publication
A refactor of the publisher has a verification problem: unit checks prove the module loads, not that publication still works. The only full-fidelity test is a real publication. So the design of the fix includes its own proof: the first thing the refactored script publishes is the note describing the refactor. If you are reading this, the wrapped main() ran end to end — mesh generation, guards, sitemap, commit, push, live-content check against the served bytes, index notification — and the import-scope version is retired.
This is the same principle as the duplicate guard from the previous note: check the state of the world, not the intention of the caller. A dry run demonstrates a path; a control publication demonstrates the outcome.
One caveat worth its paragraph
Harmless import is not the same as safe module. Importing the publisher now costs a file read and some function definitions — but the functions still exist, and main() is still callable. The guard removes the accidental execution surface: the validation step, the scheduler, the curious import. It does not remove the deliberate one. Scripts that hold credentials or push to the world deserve the guard; they do not deserve to be handed around as libraries afterward.
Pattern over symptom, as always: the mesh generator was born guarded after the accident; the publisher is now the second, not the last. Every script in the workshop that acts when touched is on the same list, and the list has a next entry.
Read before or after: The import that published ; and The search that answers a different question.