- Exports selectBlocking() and partitionAdvisories() as pure functions for unit testing - Main body guarded by import.meta.url check (only runs when invoked directly) - Uses pnpm audit --json (no --audit-level — Pitfall 1 honored) - Exits 1 on unwaived High/Critical; exits 0 with advisory report on moderate/low - All 5 unit tests pass (node --test)