fix(devx): the new staging edge gets its two declaration faces back

`check:pm-dispatch-gates` went red on the previous commit, and both failures are
registration gaps rather than logic: a new cross-module edge has three faces —
the copy surface, the declared path population, and the read key — and the last
commit repaired only the first.

⭐ Run it the way the tree already prescribes. `platform-readings.md` records
`check:pm-dispatch-gates` as exceeding the container's foreground cap and names
the remedy — detach, then wait with `tail --pid`. A timeout is not a reading,
and this gate has a recorded way to be read. Measured that way: 3 of 1730 cases
failed before, 1730/1730 pass after, 759s.

FACE 2 — the declared path population. `bump-objectui.selftest.sh` carries a
`no-path-population` marker whose own text promises that no quoted literal in it
names a tracked path. `DIGEST_ENTRY='scripts/objectui-changeset-digest.mjs'`
broke that promise: `dispatch-gates` reads a quoted literal carrying a separator
as a declared watched path, so the gate began naming paths while still declaring
it had none. The basename is spelled alone and the directory interpolated onto
it — the same idiom this file already uses for `CHANGESET_NAME`, and for the
same machine reason. ⛔ The declaration is not withdrawn and no case is relaxed.

FACE 3 — the read key. `dispatch-gates` derives "which gate does this family run
a copy of?" from an anchored `readFileSync` whose target resolves to a tracked
path; a loop variable, or a read performed inside another module, is deliberately
not followed. Folding the entry's staging into the derived walk therefore staged
it correctly and made it invisible. The entry is read by name again, and the walk
now stages only the DEPENDENCIES, so neither line is redundant with the other.

Also corrects a sentence this branch wrote about `bump-objectui.sh`: that script
swallows no stderr and its `WALK_RC` branch already separates a probe verdict
from a no-answer, refusing to offer `--unshallow` for a crash. The misleading
presentation lives in the self-test, and is carded as #18354.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk

Author: claude

scripts/bump-objectui.selftest.sh

@@ -84,13 +84,27 @@ case_begin() { CASE="$1"; echo "  • ${CASE}"; }
 # ⭐ The module list is DERIVED, not typed (#16421). It was two names here
 # (`objectui-changeset-digest.mjs`, `invoked-as.mjs`) and the same two names in
 # three other places; when the digest script gained one import, this file was the
-# THIRD staging site to go red, and the symptom it produced was not an
-# `ERR_MODULE_NOT_FOUND` a reader could act on — the digest died as a subprocess
-# and `bump-objectui.sh` reported the objectui RANGE as unwalkable, which is a
-# true sentence about the wrong thing. The derivation lives in
-# `first-party-closure.mjs` and is shared with the JS staging sites.
-DIGEST_ENTRY='scripts/objectui-changeset-digest.mjs'
+# THIRD staging site to go red, and what a reader saw was not an
+# `ERR_MODULE_NOT_FOUND` they could act on: the staged digest died as a
+# subprocess, so `range_walkable` never returned one of its two verdicts and
+# case 5 failed on the refusal's wording instead. (⚠️ `bump-objectui.sh` itself
+# is NOT at fault and is not to be touched for this: it swallows no stderr, and
+# its `WALK_RC` branch already separates a verdict from a no-answer and refuses
+# to offer `--unshallow` for a crash. See #18354 for what IS carded.) The
+# derivation lives in `first-party-closure.mjs`, shared with the JS sites.
+#
+# ⚠️ THE BASENAME IS SPELLED ALONE AND THE DIRECTORY IS INTERPOLATED ONTO IT —
+# the same discipline the declaration above states for CHANGESET_NAME, and for
+# the same machine reason: `dispatch-gates` reads a quoted literal carrying a
+# separator as a DECLARED WATCHED PATH, so writing the repo-relative path as one
+# bare token here gives this gate a path population and CONTRADICTS the
+# `no-path-population` marker above. Measured, not theorised —
+# `check:pm-dispatch-gates`: "no family both DECLARES no path population and
+# names paths anyway (contradicted: check:objectui-bump)". ⛔ Do not tidy this
+# back into a single literal.
+DIGEST_BASENAME='objectui-changeset-digest.mjs'
 REPO_ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DIGEST_ENTRY="scripts/${DIGEST_BASENAME}"
 # The same script, absolute, for the two cases that run it from THIS checkout
 # rather than from a sandbox — those need no staging at all.
 DIGEST_SCRIPT="${REPO_ROOT_DIR}/${DIGEST_ENTRY}"

scripts/objectui-changeset-digest.mjs

@@ -214,7 +214,7 @@ import { isEntrypoint } from './invoked-as.mjs';
 // #16421 — the `fw-gate` sandbox below copies `check-adr-0087-registration.mjs`
 // in and runs it. Its staging manifest is DERIVED from that gate's module graph,
 // by the same module the gate's own fixture uses, so the two cannot disagree.
-import { stageFirstPartyClosure } from './first-party-closure.mjs';
+import { firstPartyModuleClosure, stageFirstPartyClosure } from './first-party-closure.mjs';
 
 // ── The self-test's own battery roster and floor (#13489) ──────────────────
 //
@@ -2315,12 +2315,25 @@ function selfTest() {
     // the closure from the same edges Node resolves, through
     // `first-party-closure.mjs`; neither holds an opinion about the graph any
     // more, and adding an import over there costs nothing here by construction.
+    //
+    // ⚠️ THE ENTRY IS READ HERE, BY NAME, and that line is not redundant with the
+    // walk below — it is this family's REGISTRATION. `dispatch-gates` derives
+    // "which gate does this family run a copy of?" from an anchored
+    // `readFileSync` whose target resolves to a tracked path; a loop variable or
+    // a read that happens inside another module is deliberately NOT followed. So
+    // the first spelling of this fix staged the gate correctly and made the
+    // dependency invisible, and `check:pm-dispatch-gates` said so: "the staged
+    // gate reaches the family that runs a copy of it (no key)". ⛔ Do not fold
+    // this read into the walk to save a line — the walk stages the DEPENDENCIES,
+    // this read stages the GATE, and each is load-bearing for a different reader.
     const gateEntry = 'scripts/check-adr-0087-registration.mjs';
-    const gateStaged = stageFirstPartyClosure(gateEntry, { root: join(__dirname, '..'), write: gw });
+    gw(gateEntry, readFileSync(join(__dirname, 'check-adr-0087-registration.mjs'), 'utf8'));
+    const gateDeps = firstPartyModuleClosure(gateEntry, { root: join(__dirname, '..') }).filter((rel) => rel !== gateEntry);
+    for (const rel of gateDeps) gw(rel, readFileSync(join(__dirname, '..', rel), 'utf8'));
     check(
       '#6494 the staged gate carries its whole first-party closure — DERIVED, not a hand manifest',
-      gateStaged.includes(gateEntry) && gateStaged.includes('scripts/pm/check-clause2-carriers.mjs'),
-      `${gateStaged.length} file(s): ${gateStaged.join(', ')}`,
+      gateDeps.includes('scripts/pm/check-clause2-carriers.mjs') && gateDeps.length >= 2,
+      `${gateDeps.length} dependenc(ies): ${gateDeps.join(', ')}`,
     );
     gg('add', '-A');
     gg('commit', '-q', '-m', 'base');