GovernedDiamondCutLib

Three-layer pattern: this library holds all logic and the namespaced storage. The stateless GovernedDiamondCut facet delegates its single external call here.

Grants UPGRADE_EXECUTOR_ROLE to address(this) AND pins that role to administer ITSELF, so the role is held solely by address(this) and cannot be granted by anyone else. The self-administration step is load-bearing: without it the role's admin defaults to DEFAULT_ADMIN_ROLE (0x00), which would let any DEFAULT_ADMIN_ROLE holder (e.g. a live admin EOA) grantRole(UPGRADE_EXECUTOR_ROLE, attacker) and then diamondCut directly, bypassing the entire Governor + TimelockController + vote + delay path. With the role self-administered, only an existing holder can grant it — and the only holder is address(this), which the recipe reaches only through a timelock-relayed passed proposal. A co-cut facet that relays outside calls back into the diamond (e.g. AccessManager execute) reaches it too; see the UPGRADE_EXECUTOR_ROLE caveat above. _setRoleAdmin is the UNGATED setter (the gated setRoleAdmin would require the initializer to itself hold the current admin role, which is not guaranteed during bootstrap). Must be called inside the preInitializer/postInitializer window; AccessControl must already be initialized (the role writes target its storage). Does NOT register an ERC-165 interface: 0x1f931c1c is already registered by DiamondLib.registerInterface() (see the ERC165_MAP_ICUT_SLOT note above).

Guard ordering and rationale:

1. Authority FIRST: only an EMERGENCY_GUARDIAN_ROLE holder may proceed.
2. NO EmergencyStopLib.checkNotStopped() — INTENTIONAL. This is the panic button; it MUST remain usable precisely when upgrades are stopped (the same guardian who tripped the stop uses it to surgically remove the offending facet). The governed diamondCut keeps the stop gate; only this removal-only path bypasses it.
3. Removal-only: every FacetCut action must be Remove; an Add/Replace reverts IEmergencyCut.EmergencyCutMustBeRemoveOnly with the offending action. diamond-lib additionally enforces facetAddress == address(0) for Remove.
4. Entrypoint + frozen protection: diamondCut and the stop-recovery selectors (EmergencyStopLib.isRecoverySelector) revert IEmergencyCut.EmergencyCutEntrypointProtected even with an empty frozen set, and a frozen selector reverts IFrozenSelectors.FrozenSelectorProtected.
5. NO init delegatecall: applied as DiamondLib.diamondCut(cuts, address(0), ""). A pure removal has nothing to initialize, and forbidding init denies a rogue guardian any arbitrary-delegatecall vector. The removal is recorded in the SAME append-only registry as governed cuts (so it appears in cut history) and additionally emits IEmergencyCut.EmergencyCutExecuted so it is auditable as an emergency action.

Reverts IFrozenSelectors.FrozenSelectorProtected if any Replace/Remove action in _diamondCut targets a frozen selector. Add actions are never inspected. This is the shared core of both the guarded diamondCut (reverting form) and previewCut (the reverting form is reused via a try/catch-free direct read in previewCut).

Versions are 1-indexed; an unwritten version (0, or any value > cutCount) returns a zero-valued IUpgradeRegistry.CutRecord.

Thin wrapper over the shared ERC-165 support read so an upgrade workflow can confirm an expected interface is still/now advertised after a cut. Equivalent to supportsInterface.