diff --git a/library/scripts/posters/verify-posters.mjs b/library/scripts/posters/verify-posters.mjs
index f0ade270b..b9e15eadc 100644
--- a/library/scripts/posters/verify-posters.mjs
+++ b/library/scripts/posters/verify-posters.mjs
@@ -32,7 +32,7 @@ import { resolve as _resolvePath, dirname as _dirnamePath } from 'node:path'
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const DIR = process.env.POSTER_DIR || join(__dirname, 'out', 'posters');
 const PREFIX = process.argv[2] || '';
-const ROOT = _resolvePath(_dirnamePath(_fileURLToPath(import.meta.url)), '../../..')
+const ROOT = _resolvePath(_dirnamePath(fileURLToPath(import.meta.url)), '../../..')
 
 // ★ MEASURE THIS BUILD, OR MEASURE NOTHING. Several worktrees run on one machine and a default port
 // belongs to whichever server started first — measured 2026-09-24 on :4173, where browser gates
diff --git a/plugin-designs/research-map-plus-grid/scripts/check-no-free-identifiers.mjs b/plugin-designs/research-map-plus-grid/scripts/check-no-free-identifiers.mjs
index f660282c2..6d95926e3 100644
--- a/plugin-designs/research-map-plus-grid/scripts/check-no-free-identifiers.mjs
+++ b/plugin-designs/research-map-plus-grid/scripts/check-no-free-identifiers.mjs
@@ -38,7 +38,10 @@ import * as acorn from 'acorn'
 
 const TAG = 'NO-FREE-IDENTIFIERS'
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..')
-const ROOTS = ['plugin-designs', 'library']
+// internal/ too, and .mjs files (below): 30 browser gates gained `const ROOT = …(_fileURLToPath(…))` in one
+// commit, and the two that never imported it crashed on load for four days, because they run only by hand.
+// A free identifier at module scope is the same defect in a Node script as in an SFC.
+const ROOTS = ['plugin-designs', 'library', 'internal']
 
 // Vue's <script setup> compiler macros: real bindings the compiler provides, not free names.
 const VUE_MACROS = [
@@ -79,6 +82,10 @@ const GLOBALS = [
   // i18nAreasPlugin prepends `const __DX_LOCALE_SRI__ = {…}` to library/i18n/index.js; without it the
   // name does not exist, which is why its one read sits behind `typeof … !== 'undefined'`.
   '__DX_LOCALE_SRI__',
+  // Standard globals the first lists missed, found by extending the scan to internal/*.mjs: eval and
+  // EvalError; Bun in scripts `bun` runs; and window members used inside page.evaluate() callbacks,
+  // which run in the browser, not in Node.
+  'eval', 'EvalError', 'Bun', 'scrollX', 'scrollY', 'scrollTo', 'Storage',
 ]
 const PRELUDE = new Set([...VUE_MACROS, ...GLOBALS])
 
@@ -265,7 +272,7 @@ function vueFiles(dir, out = []) {
     // and the bug that emptied Big Picture's Religion and Region charts was a plain .js module:
     // useDashboardAggregations.js read NEUTRAL five times and never imported it. A bundle compiles
     // .js and .vue alike; the gate was seeing half of what ships.
-    else if (e.endsWith('.vue') || e.endsWith('.js')) out.push(p)
+    else if (e.endsWith('.vue') || e.endsWith('.js') || e.endsWith('.mjs')) out.push(p)
   }
   return out
 }
@@ -277,8 +284,10 @@ let scanned = 0
 
 for (const file of files) {
   const src = readFileSync(file, 'utf8')
+  // A dated one-shot diagnostic (tagged @one-shot, see check-no-orphan-gates) is kept as a recipe, not run.
+  if (/^\s*(?:\*|\/\/)\s*@one-shot\b/m.test(src.slice(0, 2600))) continue
   let descriptor
-  if (file.endsWith('.js')) {
+  if (file.endsWith('.js') || file.endsWith('.mjs')) {
     // A .js module is its own script block. Running it through the SFC parser is what broke the first
     // attempt at this: parseSFC found no <script>, the content came back shifted, and acorn reported
     // "Unexpected token (2:1)" — the second line of the file's own doc comment. offset 0 keeps the