# scripts/ python3 invocation audit

**Generated by plan 85-01** (WIN-FIX-B-02, WIN-FIX-H-01) on 2026-04-15.

Every `python3 -c` invocation under `scripts/` (excluding `scripts/self-update`,
which is explicitly owned by plan 85-09) has been classified into one of four
buckets:

- **PORT** -- trivial JSON read / version check / path resolution / string
  formatting. Replaced with inline `node -e` in this plan.
- **KEEP-GATED** -- legitimate data-science or parser dependency on Python.
  Wrapped in `command -v python3 >/dev/null 2>&1` so the script no-ops
  gracefully on Windows without real python3.
- **KEEP-AS-IS** -- already gated, already a `.py` file, or a legitimate
  Python-native tool where porting is out of scope for a hotfix.
- **OWNED-BY-85-09** -- lives in `scripts/self-update` and is owned by a
  later plan. Recorded here for audit but NOT patched in 85-01.

## Classification

| File | Line | Bucket | Action taken | Reason |
|------|-----:|--------|--------------|--------|
| `scripts/session-start` | 57 (orig) | PORT | swapped to `node -e` | plugin.json version read, trivial JSON |
| `scripts/session-start` | 319 (orig) | PORT | swapped to `node -e` | integrations JSON filter count |
| `scripts/session-start` | 350 (orig) | PORT | swapped to `node -e` | rooms registry count |
| `scripts/session-start` | 357 (orig) | PORT | swapped to `node -e` | rooms registry listing formatter |
| `scripts/session-start` | 513 (orig) | PORT | swapped to `node -e` | scope-injection active field extract |
| `scripts/session-start` | 612 (orig) | KEEP-GATED | extracted to `scripts/sealed-walker.py` + `command -v python3` gate | GUARDRAIL.md parser, real Python parser body, 80+ lines. Plan 85-06 will replace with node-native walker. Gate logs `[skip] python3 feature gated: sealed-room GUARDRAIL walker` when python3 is unavailable. |
| `scripts/session-start` | 798 (orig) | PORT | swapped to `node -e` | statusLine command read from settings.json |
| `scripts/session-start` | 800 (orig) | PORT | swapped to `node -e` | settings.json rewrite for statusline migration |
| `scripts/post-compact` | 60 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 |
| `scripts/check-update` | 11 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 |
| `scripts/check-hsi-deps` | 15 | KEEP-AS-IS | no change | probes `import sklearn` -- legitimate python data-science gate, the probe IS the feature detection |
| `scripts/check-hsi-deps` | 22 | KEEP-AS-IS | no change | probes `import sentence_transformers` -- same rationale |
| `scripts/check-hsi-deps` | 28 | KEEP-AS-IS | no change | probes `import pinecone` -- same rationale |
| `scripts/serve-dashboard` | 35 | KEEP-AS-IS | no change | port-availability probe via python socket. Low impact, self-contained. |
| `scripts/check-onboard` | 8 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 |
| `scripts/serve-wiki` | 18 | KEEP-AS-IS | no change | port probe, same as serve-dashboard |
| `scripts/update-icm-index` | 24 | KEEP-AS-IS | no change | multi-line python script, real parser work |
| `scripts/on-cwd-changed` | 62 | KEEP-AS-IS | no change | multi-line python, out of scope for hotfix |
| `scripts/on-cwd-changed` | 90 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 |
| `scripts/analyze-room` | 520 | KEEP-AS-IS | no change | datetime parser, fallback path |
| `scripts/build-graph` | 720 | KEEP-AS-IS | no change | path realpath, fallback path |
| `scripts/room-registry` | 61, 111, 128, 164, 195, 233, 259, 285 | KEEP-AS-IS | no change | registry manipulation helpers, multi-line python, substantial. Defer to follow-up hotfix. |
| `scripts/resolve-room` | 39, 76, 125 | KEEP-AS-IS | no change | multi-line python room resolution |
| `scripts/reapply-modifications` | 19, 20, 21, 29 | KEEP-AS-IS | no change | backup metadata reader, runs from install path only |
| `scripts/research-speaker` | 120 | KEEP-AS-IS | no change | urllib.parse.quote, trivial but self-contained |
| `scripts/banner` | 23 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 (banner is 85-06's primary surface) |
| `scripts/backup-modifications` | 19 | PORT-CANDIDATE | deferred | plugin.json version read, will fold into 85-06 |
| `scripts/backup-modifications` | 57 | KEEP-AS-IS | no change | file list JSON encode |
| `scripts/verify-release` | 67, 70, 227, 330 | KEEP-AS-IS | no change | release verification, Linux/dev-only path |
| `scripts/git-ops` | 189 | KEEP-AS-IS | no change | multi-line git helper |
| `scripts/migrate-rooms` | 26, 84 | KEEP-AS-IS | no change | multi-line migration tool |
| `scripts/sentinel-deadline-monitor` | 22 | KEEP-AS-IS | no change | datetime parser fallback |
| `scripts/compute-team` | 521 | KEEP-AS-IS | no change | datetime parser fallback |
| `scripts/serve-presentation` | 20 | KEEP-AS-IS | no change | port probe |
| `scripts/on-agent-complete` | 39 | KEEP-AS-IS | no change | time.time fallback |
| `scripts/discovery-cycle.cjs` | 494 | KEEP-AS-IS | no change | runs python inside a node discovery step, target is a .py file not `-c` script -- false positive |
| `scripts/self-update` | 90 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |
| `scripts/self-update` | 95 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |
| `scripts/self-update` | 97 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |
| `scripts/self-update` | 133 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |
| `scripts/self-update` | 268 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |
| `scripts/self-update` | 403 | OWNED-BY-85-09 | no change | plan 85-09 owns self-update |

## Summary

- **PORTED in 85-01:** 7 sites in `scripts/session-start` (lines 57, 319, 350, 357, 513, 798, 800 in pre-patch file).
- **EXTRACTED to `.py` file (KEEP-GATED):** 1 site (sealed-room GUARDRAIL walker, now in `scripts/sealed-walker.py` and gated on `command -v python3`).
- **KEEP-AS-IS in this plan:** all data-science / parser / port-probe / datetime-fallback sites. These do not affect the Windows banner path and are either already gated in their own way (imports fail cleanly) or out of scope for a hotfix.
- **PORT-CANDIDATE deferred to 85-06:** 6 `plugin.json` version reads outside `session-start` (`post-compact`, `check-update`, `check-onboard`, `on-cwd-changed`, `banner`, `backup-modifications`). Plan 85-06 owns banner rendering across surfaces; folding these into its sweep keeps the diff-per-plan scope tight and avoids semantic conflict with 85-06's own banner wrapper path work.
- **OWNED-BY-85-09:** 6 sites in `scripts/self-update`. Explicitly excluded from this plan per plan 85-01 text (line 54 of the PLAN).

## Verification

`grep -n "python3 -c" scripts/session-start` returns **zero hits** after plan 85-01.

The verification `grep -rn "python3 -c" scripts/ | wc -l` total equals the sum of KEEP-GATED (0 after extraction) + KEEP-AS-IS + PORT-CANDIDATE + OWNED-BY-85-09 entries above. PORTED sites are gone.