diff --git a/.changeset/quiet-moons-derive.md b/.changeset/quiet-moons-derive.md
index 319ada4f0..822cfb724 100644
--- a/.changeset/quiet-moons-derive.md
+++ b/.changeset/quiet-moons-derive.md
@@ -3,3 +3,5 @@ type: Added
 pr: 2677
 ---
 **`runtime-homes` now exports its non-registry config-home descriptors** — `KIMI_HOOKS_TOML_DESCRIPTOR`, `NON_REGISTRY_CONFIG_HOME_DESCRIPTORS`, `GSD_LOCATION_ENV_KEYS`, and the `ConfigHomeDescriptor` type are public, so consumers that need the *set* of config-location env vars (rather than a single resolved path) can derive it instead of hand-maintaining a copy. `resolveKimiHooksTomlDir()` behaviour is unchanged; its descriptor is simply named rather than inline (#2665).
+
+**The test-instrumentation scripts no longer ship in the npm package** — `scripts/run-tests.cjs`, `scripts/live-config-guard.cjs`, `scripts/affected-tests-lib.cjs`, and `scripts/run-affected-tests.cjs` are now excluded from the tarball (they are one closed require chain of repo-only test tooling). `npm test` in an installed package was already inoperable (`tests/` has never shipped); a deep import of `scripts/run-tests.cjs` from the published package — an unsupported surface — will now be `MODULE_NOT_FOUND` (#2665).
diff --git a/CONTEXT.md b/CONTEXT.md
index d1d29ad76..f4941a753 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -592,7 +592,7 @@ The prompt-level data/instruction isolation seam for untrusted web/document ingr
 `CONFIG.LOCATION.SEAM.two-families=runtime configHomes (where a third-party runtime keeps config, registry- or descriptor-declared) and GSD's OWN location vars (GSD_HOME -> $GSD_HOME/.gsd store, GSD_AGENTS_DIR -> getAgentsDir priority 1) are DISTINCT families; no registry derivation reaches the second, and treating a miss there as a registry gap is what produced review round 2`
 `CONFIG.LOCATION.SEAM.kimi-two-homes=kimi declares TWO config-location vars: KIMI_CONFIG_DIR (registry, generic Agent-Skills root via resolveKimiGlobalDir) and KIMI_SHARE_DIR (KIMI_HOOKS_TOML_DESCRIPTOR, kimi's OWN native config.toml carrying GSD's [[hooks]] block via resolveKimiHooksTomlDir); a registry-only derivation covers the first and silently misses the second`
 `CONFIG.LOCATION.SEAM.in-process-scrub=TEST_ENV_BASE reaches CHILD env only; a test calling install() IN-PROCESS must additionally use helpers.scrubConfigLocationEnv() in beforeEach + its restorer in afterEach — HOME/USERPROFILE sandboxing is NOT sufficient because getGlobalConfigDir is env-FIRST`
-`LIVE-CONFIG.GUARD.SEAM.module=scripts/live-config-guard.cjs (deliberately NOT scripts/lib/, which the installer copies to users wholesale while uninstall removes only an allowlist); exports [resolveLiveConfigRoots, resolveExtraWatchTargets, snapshotLiveConfig, diffLiveConfig, formatViolations, newestMtime]; driven by scripts/run-tests.cjs pre/post suite`
+`LIVE-CONFIG.GUARD.SEAM.module=scripts/live-config-guard.cjs (deliberately NOT scripts/lib/, which the installer copies to users wholesale while uninstall removes only an allowlist; excluded from the npm tarball via package.json files[] together with its whole require chain run-tests.cjs/affected-tests-lib.cjs/run-affected-tests.cjs — a partial exclusion trips the #2858 shipped-requires-only-shipped gate); exports [resolveLiveConfigRoots, resolveExtraWatchTargets, snapshotLiveConfig, diffLiveConfig, formatViolations, newestMtime]; driven by scripts/run-tests.cjs pre/post suite`
 `LIVE-CONFIG.GUARD.SEAM.scope=ownership-based, never whole-root: GSD_OWNED_ENTRIES top-level footprint + gsd--prefixed children of GSD_PREFIXED_PARENTS (dirs shared with the host agent); watching a shared root wholesale false-positives on the host's own writes and a guard that cries wolf gets disabled`
 `LIVE-CONFIG.GUARD.SEAM.non-root-targets=resolveExtraWatchTargets covers the two live write surfaces that are not runtime config ROOTS: $GSD_HOME/.gsd watched WHOLESALE (exclusively GSD-owned, so the shared-root trap does not apply) and <resolveKimiHooksTomlDir()>/config.toml watched as a SINGLE FILE (the root belongs to Kimi CLI); passed to snapshotLiveConfig explicitly so a fixture-root caller cannot pull the real ~/.gsd into its snapshot`
 `LIVE-CONFIG.GUARD.SEAM.truncation=MAX_ENTRIES/MAX_DEPTH bound the walk; a bound hit sets truncated and diffLiveConfig emits kind:'unverified' — a truncated scan MUST NOT read as clean; boundary covered at {limit-1,limit,limit+1} via newestMtime's injected budget plus fast-check monotonicity, per RULESET.TESTS.boundary-coverage + RULESET.TESTS.property-based-testing`
diff --git a/package.json b/package.json
index 88d2694b7..5e086764c 100644
--- a/package.json
+++ b/package.json
@@ -23,6 +23,10 @@
     "scripts",
     "!scripts/gen-emitted-baseline.cjs",
     "!scripts/qa-smell-ratchet.cjs",
+    "!scripts/live-config-guard.cjs",
+    "!scripts/run-tests.cjs",
+    "!scripts/affected-tests-lib.cjs",
+    "!scripts/run-affected-tests.cjs",
     "pi",
     "vscode"
   ],
diff --git a/scripts/live-config-guard.cjs b/scripts/live-config-guard.cjs
index 883aab154..8b645d099 100644
--- a/scripts/live-config-guard.cjs
+++ b/scripts/live-config-guard.cjs
@@ -22,8 +22,11 @@
  * LOCATION — `scripts/`, deliberately NOT `scripts/lib/`. The installer copies
  * `scripts/lib/` into every user's config dir wholesale (readdirSync), while
  * uninstall removes only an explicit allowlist, so a test-only module placed
- * there would ship to users AND survive uninstall. `scripts/affected-tests-lib.cjs`
- * is the precedent for a non-shipped helper at this level.
+ * there would ship to users AND survive uninstall. This file is also excluded
+ * from the npm tarball (`package.json` `files[]` `!scripts/live-config-guard.cjs`,
+ * alongside its whole require chain: run-tests.cjs, affected-tests-lib.cjs,
+ * run-affected-tests.cjs — excluding one link alone would trip the #2858
+ * shipped-requires-only-shipped gate on the links that still shipped).
  *
  * SCOPE — ownership-based, not whole-root. It watches entries GSD unambiguously
  * owns: the top-level install footprint (`GSD_OWNED_ENTRIES`) plus `gsd-`-prefixed