[thekevinbot]

Part of #1042 (parent #1020). PR E of that campaign, targeting max_lines = 12 rather than 10.

internals/distcheck/src/distcheck/node_flow/gate.py holds two module-scope functions over a 12-line threshold, so one-function-per-file flags run (89 lines) for sharing a file with its holder, select_tarball (13 lines).

What moved

The holder, not run — following #1040's precedent that gate.py is the orchestration entry point callers import from (node_flow/cli.py imports run and DistcheckError from it).

• node_flow/tarball.py — select_tarball, with colocated tarball_test.py. Its five test cases were relocated out of gate_test.py, not duplicated, plus one new case asserting the diagnostic names the prefix, the matches and the full candidate list.
• node_flow/errors.py — DistcheckError, with colocated errors_test.py. select_tarball raises it and gate.py imports select_tarball, so leaving the class in gate.py would have made the new edge a cycle. gate.py re-exports it, so node_flow/cli.py and gate_test.py's import site are unchanged.

run is untouched — at 12 it holds its own file. Both new imports in gate.py are relative, per AGENTS.md.

No testing-conventions.toml is edited. A follow-up PR drops the ceilings once every split in the campaign has landed; this one is a pure refactor.

Verification

Gate, with testing-conventions@0.0.111 pinned and a throwaway config supplying max_lines = 12 (the root config is untouched, and this root passes no config: so it reads the root [python] table):

npx -y testing-conventions@0.0.111 unit one-function-per-file \
  --language python --config /tmp/tc-12.toml internals/distcheck/src

• Before: gate.py:69: one-function-per-file — run runs 89 lines, and select_tarball already holds this file — 1 violation.
• After: clean, 0 violations.

just preflight --conventions .github/workflows/internals-distcheck-ci.yml: 0 failing pairs, 0 skipped — uv-sync, declared-deps, colocated-test, one-function-per-file, unit-lint, integration-lint, unit-coverage, mutation. Mutation: no surviving mutants — every mutation was caught (13 mutant(s) tested). Full just preflight also run.

uv run pytest -q in internals/distcheck: 69 passed, 1 skipped.

Manual run: uv run --project internals/distcheck dirsql-distcheck node — the flow imports and executes through the split modules and stops at its documented prerequisite (prerequisite missing: <repo>/packages/ts/build/linux-x64-gnu/dirsql.linux-x64-gnu.node. Run pnpm build from packages/ts first.) rather than an ImportError, which is the observable proof the new module graph resolves end to end from the CLI entry point.

Red/green does not apply. This is a behaviour-preserving move: no new behaviour, no changed behaviour, no removed behaviour. The relocated tests were green before the move and are green after it, in their new file.

Obligations

Each re-confirmed against the repo rather than assumed.

• Changelog fragment: none owed. internals/checks/src/checks/changelog_gate/decide.py has _ROOTS = ("packages", "plugins"); internals/ is outside the gate entirely.
• E2E receipt: none owed. internals-distcheck-ci.yml declares gates: '["colocated-test", "unit-lint", "integration-lint", "unit-coverage", "mutation"]' — no e2e-verify, unlike internals-checks-ci.yml which does declare it. Independently corroborated by just preflight --dry-run, whose matrix lists an e2e-verify pair for internals-checks, python-sdk, typescript-sdk and plugins-embeddings, and none for internals-distcheck.
• Migration fragment: none. Behaviour-preserving; every moved symbol keeps its import path working via the gate.py re-export.
• PARITY.md: no change. No SDK public API is touched; neither symbol appears in PARITY.md.

E2E Verification

N/A - no SDK source touched (internals/distcheck only).

Changelog / Migrations

• Changelog fragment not required — changelog_gate scopes to packages/ and plugins/ only
• Migration fragment not required — behaviour-preserving refactor