feat(devx): the clause-② declaration grows a direction arm, and three gates read it (#18346)

Fixes #16421

Clause-②: no

A gate strengthens; no published runtime contract moves. Stated by the
ruling, and re-derived here: the declaration's accept set only grows
(the arm is optional and every existing spelling reads
byte-identically), and the three gates that read it become stricter,
never looser.

## The defect

A **narrowing** — "these spellings stop being accepted" — could ship to
customers with the release notes saying nothing, and every gate green.
`check-adr-0087-registration.mjs` decided breaking-ness from an author's
hand-written `**BREAKING**` prose banner; an author who did not type it
was classified non-breaking and was asked for no ADR-0087 disposition.

Measured, not hypothesised: **#16296** narrowed `sys_job.timezone` /
`sys_report_schedule.timezone` to the IANA value domain and shipped with
no banner, no `major` and no `!`. **#14238** did the same one surface
earlier.

## The ruling being executed

Director summon #17, decision batch #2 item 1, **option B**, maintainer
verbatim 「同意」 (comment `5572145955`, 2026-09-07T14:32:32Z). Options A
(keep the prose banner) and C (a static accept-set differ) are refused
there and are not reopened here.

## What landed

| # | deliverable | where |
| --- | --- | --- |
| 1 | the closed two-arm enumeration in the declaration format |
`AGENTS.md` item 3 |
| 2 | `readClause2Line` reads the arm — **once**, no second parser |
`scripts/pm/check-clause2-carriers.mjs` |
| 3 | signal (4): a declared `narrowing` is breaking |
`scripts/check-adr-0087-registration.mjs` |
| 4 | the level axis reads the arm |
`scripts/check-changeset-no-major.mjs` |
| 5 | **ONE** ADR-0087 ledger row, recording #16296 |
`packages/spec/src/migrations/entries/semantic/` |

> ⚠️ **Row 5 is deliberately one row, not the two the ruling names —
corrected by the `domain:devx` seat (#6023) on the dev's measurement.**
> The ruling lists #14238 and #16296 as the two already-shipped
narrowings. **#14238 is not a narrowing**: its diff is 535 insertions
and 0 deletions across 11 files (two nullable columns ADDED, carrying
`valueDomain: 'iana_time_zone'` from their first release), and its own
shipped changeset says so in writing — *"A NON-BREAKING ADDITION,
registered here in writing because ADR-0087's registries have no
additive entry kind"*.
> A row claiming it narrowed something would be false data in the one
ledger this mechanism keeps true, which ADR-0087's #13080 addendum
refuses by name. ⇒ One row is written, the second is **not fabricated**,
and the falsified premise is carried to the maintainer rather than
silently dropped.

> ⚠️ **The citation above was wrong in the dispatch order and is
corrected here.** The seat's dispatch word cited comment `5573372199`,
which answers **HTTP 404**; the real ruling is `5572145955` (HTTP 200,
verified by both the dev and the seat). The quoted ruling text itself is
unchanged — only the provenance id moved.
| 6 | pins for both arms, in both directions | the three gates'
self-tests |

### The shape

| spelling | reading |
| --- | --- |
| `Clause-②: yes` | a widening, declared through the value — unchanged |
| `Clause-②: yes (widening)` | the same, said out loud |
| `Clause-②: yes (narrowing)` | widens one surface, narrows another;
both facts are read |
| `Clause-②: no (narrowing)` | NOT a widening, but BREAKING — the point
of the arm |
| `Clause-②: no (widening)` | MALFORMED: the value and the arm
contradict each other |

(The rows are table cells on purpose: a line-initial second declaration
in this body would be a second answer to the same question.)

The arm is **optional**, and that is a measurement rather than a
kindness: all five declarations on the open board the day this landed
carry no parenthetical arm, and all five read byte-identically
afterwards (proof below).

Two shapes fail **closed** rather than reading as an absent arm, because
reading them as absent is the direction a declared narrowing silently
disappears in: a near-arm spelling (`(narrowed)`, `(Narrowing)`,
`(widen)`) and the unfilled template `(widening|narrowing)`. Both land
in `malformed`, the state this reader already owns for "the slot holds
something nobody can grade".

## Measurements

### Back-compat — the five in-flight declarations

Read from the live GitHub payload, before and after the change,
comparing the whole reading object:

| PR | reading | arm |
| --- | --- | --- |
| #18344 | `declared no` — IDENTICAL | none |
| #18268 | `declared no` (em-dash reasoning, parenthesised identifiers)
— IDENTICAL | none |
| #18231 | `near-miss inline-key` — IDENTICAL | n/a |
| #18227 | `declared no` — IDENTICAL | none |
| #18096 | `declared no` — IDENTICAL | none |

**5/5 byte-identical** apart from the additive `arm: null` field.
Nothing in flight loses its reading.

### `AGENTS.md` — both ratchet axes

Its line ratchet has **zero headroom** (1075 lines, ceiling 1075), so
the format is carried at **net zero lines**, paid for by deleting
content rather than by re-wrapping:

- deleted: the widening-rationale clause (`the widening it declares is
what makes it more than a patch…`), 93 bytes;
- deleted: the CI step name the gate already prints in its own failure,
78 bytes.

| axis | before | after |
| --- | --- | --- |
| lines | 1075 / ceiling 1075 | **1075** — headroom 0, unchanged |
| widest line | ≤ 120 bytes | edited lines measure 119 / 118 / 120 / 119
/ 81 bytes |
| widest table row | 768 / pin 768 | **768**, untouched |

`check:pm-skill-ratchet` self-test and run both exit 0.

### Both arms, both directions

Every arm pin is a **pair**, because one direction alone cannot tell a
reading from a constant — a gate that classified both arms as breaking
would satisfy a `narrowing` test while telling a consumer nothing:

- `check-adr-0087-registration`: `narrowing` is in
`MUST_MATCH_BREAKING`, `widening` is in `MUST_NOT_MATCH_BREAKING`, both
on a banner-free `minor` changeset — the exact shape #16296 shipped in.
- `check-changeset-no-major`: same tree, same levels, only the
declaration moves — `no (narrowing)` reaches `enforce`, bare `no`
reaches `not-declared`.
- `check-clause2-carriers`: both arms read; the contradiction, the
near-arm family and the unfilled menu are all `malformed`; and three
CONTROL rows pin the arm-less spellings unmoved.

## Two judgement calls, declared rather than made quietly

1. **The `**BREAKING**` banner signal is KEPT.** The dispatch word asked
for breaking-ness to stop being read from the prose banner. Removing
signal (2) would un-declare the **52 changesets in stock** that carry it
and nothing else — the gate's own docblock has refused that direction
("narrowing to any one of them would drop real declarations") since it
was written, and the ruling's own text asks only that the gate *read the
arm*. Signal (4) is added beside it, so breaking-ness no longer
**depends** on prose. If the maintainer wants (2) retired, that is a
second, deliberate card with its own stock count.
2. **`check-adr-0087-registration` reads the arm from the CHANGESET
body, not the PR body.** It has no pull-request payload by construction
— `cut-rc.yml` runs it on a `workflow_dispatch` over a whole snapshot
range with no PR at all. All three of its existing signals are
changeset-local, and the fourth is too.

## Acceptance notes

- noted, not filed: `readClause2Correction` does not carry the arm. A
correction comment can change a declaration's *value* but not its
*direction*. No half-state results today — the arm's three readers are
the changeset body (ADR-0087), the PR body (no-major) and this file's
own rows, and none of them reads corrections — so this is recorded
rather than filed. Carrier: `scripts/pm/check-clause2-carriers.mjs`, the
next card that touches `readClause2Correction`.
- noted, not filed: the I1/I2 fixture in
`check-adr-0087-registration.mjs` staged its import siblings from a
hand-written two-name list. Signal (4) added an edge into a nine-module
closure including `pm/dispatch-gates.mjs`, so the list is now
**derived** by walking real import statements. That is a guard extension
inside this card's own defect class, not a drive-by: without it, the
next import added over in `pm/` would kill this gate's fixture with an
error about neither file.

## 维护者速读(草稿)

**改了什么** —「本卡是否放宽契约」这条申报,现在可以再带一个方向:`(widening)` 或
`(narrowing)`,只有这两种拼法。声明 `(narrowing)` 的改动会被三个门禁当作破坏性变更处理:必须写 ADR-0087
处置、必须给到 `minor` 档。`AGENTS.md` 记下格式,行数一行没多。

**为什么改** — 一次「以后不再接受某些写法」的收紧,过去可以在发布说明里一个字都不提就发给客户,所有门禁照样亮绿:门禁是从作者手写的
`**BREAKING**` 横幅判断破坏性的,忘了写就当没有。#16296 和 #14238
就是这么发出去的。改完之后,判据是一个封闭的词,不是一段散文。

**风险与代价(含回滚)** — 风险面是「在飞的申报会不会一夜失效」。方向词是可选的,板上 5 个在飞 PR
的申报实测全部逐字不变,已列在上面的表里。代价是作者多写一个词,并且要把同一行抄进 changeset
正文。两条已申报的判断:`**BREAKING**` 横幅这条旧信号保留(库存里 52 个 changeset 只靠它),以及 ADR-0087
门禁从 changeset 正文读方向(它跑 RC 切版时根本没有 PR)。回滚是单笔
revert:三个门禁各自的自测都是新增用例,没有既有用例被改写。

**席位意见** — (留空,复核席定稿)

**你要做的** — 确认两件事:① 旧的 `**BREAKING**`
横幅信号保留,是否合你意(裁定原文只说「读分肢」,派发词的转述是「不再从横幅判断」);② 两条 ADR-0087
账本行记的是平台对象列的取值域收紧 —— 该账本服务的是元数据升级者,请确认这两行落在那里是你要的记录位置。

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

---
_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: claude[bot] <noreply@anthropic.com>

Author: os-try-charles

.changeset/16421-clause2-direction-arm.md

@@ -0,0 +1,30 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): record the shipped `sys_job` / `sys_report_schedule` IANA narrowing in the ADR-0087 ledger (#16421)
+
+Clause-②: no
+
+`#16296` gave `sys_job.timezone` and `sys_report_schedule.timezone` the
+`valueDomain: 'iana_time_zone'` declaration. That is a write-time narrowing — a
+string these columns used to accept is now refused with the ADR-0114 field code
+`value_domain` — and it shipped with no breaking-change marker at all, so the
+repo's own detector classified it non-breaking and asked for no ADR-0087
+disposition. Measured on the shipped changeset, not inferred.
+
+The ledger now carries a `semantic` entry for it
+(`platform-timezone-columns-iana-domain-refused`, protocol 18). Nothing is
+re-released and nothing is ratified in silence: the entry states what narrowed,
+the one-line fix per offending row (write the canonical zone id, or clear the
+column), and the fact that a stored non-member is still readable and still
+returned unchanged — it fails only on the row's next write. For
+`sys_report_schedule` that refusal is the point: a non-member zone was silently
+discarding the cron expression and falling back to `interval_minutes` forever.
+
+No authorable key, export, config field or stored shape moves, and no DDL is
+planned — this is a record of a change that already shipped, published so that
+`objectstack migrate meta`'s consumers can read it.
+
+Maintainer ruling, director summon #17, decision batch #2 item 1, option B
+(#16421 comment 5572145955, 2026-09-07), quoted verbatim and untranslated: 「同意」.

AGENTS.md

@@ -1064,8 +1064,8 @@ Both non-handshake shapes, and how to classify and probe your own:
 3. **Add a changeset for anything that publishes.** Feature, functional improvement or fix — run `pnpm changeset`
    (or add a `.changeset/*.md` entry) describing it before committing. A bug fix in a released package takes a
    **`patch`** changeset — never none, and ⛔ never `skip-changeset`: that label is for a diff that publishes
-   nothing from any released package. A PR that declares `Clause-②: yes` takes at least **`minor`** instead —
-   the widening it declares is what makes it more than a patch, whatever else the diff fixes.
+   nothing from any released package. The declaration is `Clause-②: yes|no` plus at most one arm from the closed pair
+   `(widening)`/`(narrowing)`: `yes` takes at least **`minor`**, `(narrowing)` is BREAKING, `no (widening)` malformed.
    **Breaking changesets must carry their migration.** If the change removes or renames anything an author can write (a
    spec key, an export, a config field), the changeset body must state the FROM → TO mapping and the one-line fix —
    this text ships to consumers as `CHANGELOG.md` inside the npm package and is what an upgrading agent greps after the
@@ -1075,9 +1075,9 @@ Both non-handshake shapes, and how to classify and probe your own:
    schema is `.strict()`. The changeset is one of fourteen surfaces a retirement touches — follow the
    `spec-property-retirement` skill (`.claude/skills/`) rather than reconstructing the kit, and note the two routes
    imply **opposite** liveness-ledger dispositions.
-   **A breaking changeset must also state its ADR-0087 disposition, in writing** — exactly one marker in the
-   changeset body, enforced by `pnpm check:adr-0087-registration` (CI step *Require an ADR-0087 disposition on a
-   declared-breaking changeset*). ⛔ The categories are NOT copied here — the gate prints the full set when it fails.
+   **A breaking changeset must also state its ADR-0087 disposition, in writing** — exactly one marker in the changeset
+   body, which also carries the PR's `Clause-②` line: `pnpm check:adr-0087-registration` reads the arm there. ⛔ The
+   categories are NOT copied here — the gate prints the full set when it fails.
 4. **A removal that breaks the pinned sibling checkout ships together with the sibling fix and the pin bump — or it
    does not ship.** The `Console Pin Gate` job builds objectui at the pinned `.objectui-sha` against **current** `main`,
    so a removal or rename the pinned sibling still imports turns `main` red for every PR in the repo the moment it

packages/spec/src/migrations/entries/semantic/18.platform-timezone-columns-iana-domain-refused.ts

@@ -0,0 +1,59 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'platform-timezone-columns-iana-domain-refused',
+  surface:
+    'The two platform audit time-zone columns — `sys_job.timezone` and '
+    + '`sys_report_schedule.timezone` — carrying a string that is not a member of the '
+    + 'IANA time-zone database (`Asia/Shangai`, `Europe/Munich`, `UTC+8`, `PST`).',
+  replacement:
+    'The canonical IANA zone id the deployment meant, written in the spelling the tzdb '
+    + 'uses: `Asia/Shanghai`, `Europe/Berlin`, `America/Los_Angeles`. `UTC` is a member '
+    + 'and is admitted — membership is the shared `Intl.DateTimeFormat` probe, never the '
+    + '`Intl.supportedValuesOf(\'timeZone\')` enumeration, which omits `UTC` and would '
+    + 'refuse the one fallback this contract names. ⚠️ A non-member is RE-AUTHORED, never '
+    + 'repaired on the deployment\'s behalf: the correct zone behind a typo is a fact only '
+    + 'the deployment holds, which is what makes this entry semantic rather than a D2 '
+    + 'conversion.',
+  reason:
+    '#16296 gave both columns `valueDomain: \'iana_time_zone\'`, which had been declared '
+    + 'on `sys_business_unit.timezone` / `sys_organization.timezone` since #14238. It is a '
+    + 'WRITE-TIME narrowing of the `min`/`max`/`maxLength` transition-gate class: a value '
+    + 'already stored outside the domain is never re-read against it, no DDL is planned, '
+    + 'and `objectstack migrate meta` has nothing to rewrite — the changeset that shipped '
+    + 'it says so in those words, and this entry does not contradict it. What the '
+    + 'changeset had no way to carry is that a deployment holding such a value now has '
+    + 'WORK TO DO: the next write of that row is refused with the ADR-0114 field code '
+    + '`value_domain`, and until then `sys_report_schedule.timezone` keeps doing the thing '
+    + 'the narrowing exists to stop — `ReportService.nextRunAt` hands a non-member zone to '
+    + 'croner, whose throw was caught and turned into a silent fall back to '
+    + '`interval_minutes`, so "every weekday 09:00 Asia/Shanghai" became "every 1440 '
+    + 'minutes, forever". Not a throw and not a fall back to UTC: the wrong instant, '
+    + 'permanently. ⛔ It went out with NO `**BREAKING**` marker, so the repo\'s own '
+    + 'breaking-change detector classified it non-breaking and asked for no ADR-0087 '
+    + 'disposition at all — measured on the shipped changeset. #16421 closed that hole '
+    + '(the declaration now carries a `(narrowing)` arm the gate reads instead of a prose '
+    + 'banner) and this row is the other half of the same ruling: the narrowing that '
+    + 'already shipped is RECORDED, ⛔ not re-released and ⛔ not ratified in silence. '
+    + 'Maintainer ruling, director summon #17, decision batch #2 item 1, option B '
+    + '(objectstack#16421 comment 5572145955, 2026-09-07), verbatim and untranslated: 「同意」. The direct precedents for registering a change '
+    + 'no transform can apply are `schedule-flow-acting-organization-required` (protocol '
+    + '18) and `rest-requireauth-default-flip` (protocol 12) — behaviour-only, a '
+    + 'deployment judgement, registered anyway because the prescription is real.',
+  acceptanceCriteria:
+    'Every `sys_job.timezone` and `sys_report_schedule.timezone` value stored in the '
+    + 'deployment is an IANA member. The one-line fix per offending row: write the '
+    + 'canonical zone id (`UPDATE … SET timezone = \'Asia/Shanghai\'`), or clear the '
+    + 'column — `sys_report_schedule` documents a `UTC` default and `sys_job` has no '
+    + 'reader at all. Rows already holding a member parse and behave byte-identically to '
+    + 'before; rows holding none are readable, are returned unchanged, and fail only on '
+    + 'their next WRITE. A report schedule that was silently running on '
+    + '`interval_minutes` resumes its cron cadence once its zone is a member — that '
+    + 'resumption, not the absence of an error, is how the fix is verified. ⚠️ The two '
+    + 'columns\' `maxLength` (100 vs 64) and defaults (none vs `UTC`) are deliberately '
+    + 'still unconverged and are NOT part of this entry; no member is longer than 32 '
+    + 'characters on the current Node baseline, so neither bound admits anything the '
+    + 'domain does not.',
+};

packages/spec/src/migrations/registry.ts

@@ -9676,6 +9676,61 @@ const step18: MigrationStep = {
         + 'who was previously outside an `assignedProfiles` list and could nonetheless open the page '
         + 'is the pre-existing state, not a regression introduced by the removal.',
     },
+    {
+      id: 'platform-timezone-columns-iana-domain-refused',
+      surface:
+        'The two platform audit time-zone columns — `sys_job.timezone` and '
+        + '`sys_report_schedule.timezone` — carrying a string that is not a member of the '
+        + 'IANA time-zone database (`Asia/Shangai`, `Europe/Munich`, `UTC+8`, `PST`).',
+      replacement:
+        'The canonical IANA zone id the deployment meant, written in the spelling the tzdb '
+        + 'uses: `Asia/Shanghai`, `Europe/Berlin`, `America/Los_Angeles`. `UTC` is a member '
+        + 'and is admitted — membership is the shared `Intl.DateTimeFormat` probe, never the '
+        + '`Intl.supportedValuesOf(\'timeZone\')` enumeration, which omits `UTC` and would '
+        + 'refuse the one fallback this contract names. ⚠️ A non-member is RE-AUTHORED, never '
+        + 'repaired on the deployment\'s behalf: the correct zone behind a typo is a fact only '
+        + 'the deployment holds, which is what makes this entry semantic rather than a D2 '
+        + 'conversion.',
+      reason:
+        '#16296 gave both columns `valueDomain: \'iana_time_zone\'`, which had been declared '
+        + 'on `sys_business_unit.timezone` / `sys_organization.timezone` since #14238. It is a '
+        + 'WRITE-TIME narrowing of the `min`/`max`/`maxLength` transition-gate class: a value '
+        + 'already stored outside the domain is never re-read against it, no DDL is planned, '
+        + 'and `objectstack migrate meta` has nothing to rewrite — the changeset that shipped '
+        + 'it says so in those words, and this entry does not contradict it. What the '
+        + 'changeset had no way to carry is that a deployment holding such a value now has '
+        + 'WORK TO DO: the next write of that row is refused with the ADR-0114 field code '
+        + '`value_domain`, and until then `sys_report_schedule.timezone` keeps doing the thing '
+        + 'the narrowing exists to stop — `ReportService.nextRunAt` hands a non-member zone to '
+        + 'croner, whose throw was caught and turned into a silent fall back to '
+        + '`interval_minutes`, so "every weekday 09:00 Asia/Shanghai" became "every 1440 '
+        + 'minutes, forever". Not a throw and not a fall back to UTC: the wrong instant, '
+        + 'permanently. ⛔ It went out with NO `**BREAKING**` marker, so the repo\'s own '
+        + 'breaking-change detector classified it non-breaking and asked for no ADR-0087 '
+        + 'disposition at all — measured on the shipped changeset. #16421 closed that hole '
+        + '(the declaration now carries a `(narrowing)` arm the gate reads instead of a prose '
+        + 'banner) and this row is the other half of the same ruling: the narrowing that '
+        + 'already shipped is RECORDED, ⛔ not re-released and ⛔ not ratified in silence. '
+        + 'Maintainer ruling, director summon #17, decision batch #2 item 1, option B '
+        + '(objectstack#16421 comment 5572145955, 2026-09-07), verbatim and untranslated: 「同意」. The direct precedents for registering a change '
+        + 'no transform can apply are `schedule-flow-acting-organization-required` (protocol '
+        + '18) and `rest-requireauth-default-flip` (protocol 12) — behaviour-only, a '
+        + 'deployment judgement, registered anyway because the prescription is real.',
+      acceptanceCriteria:
+        'Every `sys_job.timezone` and `sys_report_schedule.timezone` value stored in the '
+        + 'deployment is an IANA member. The one-line fix per offending row: write the '
+        + 'canonical zone id (`UPDATE … SET timezone = \'Asia/Shanghai\'`), or clear the '
+        + 'column — `sys_report_schedule` documents a `UTC` default and `sys_job` has no '
+        + 'reader at all. Rows already holding a member parse and behave byte-identically to '
+        + 'before; rows holding none are readable, are returned unchanged, and fail only on '
+        + 'their next WRITE. A report schedule that was silently running on '
+        + '`interval_minutes` resumes its cron cadence once its zone is a member — that '
+        + 'resumption, not the absence of an error, is how the fix is verified. ⚠️ The two '
+        + 'columns\' `maxLength` (100 vs 64) and defaults (none vs `UTC`) are deliberately '
+        + 'still unconverged and are NOT part of this entry; no member is longer than 32 '
+        + 'characters on the current Node baseline, so neither bound admits anything the '
+        + 'domain does not.',
+    },
     {
       id: 'plugin-auto-restart-never-reinitialised',
       surface:

scripts/bump-objectui.selftest.sh

@@ -77,11 +77,37 @@ bad()  { echo "    ✗ $*" >&2; FAILED=$((FAILED + 1)); }
 case_begin() { CASE="$1"; echo "  • ${CASE}"; }
 
 # case_5 additionally needs a copy of the digest script `bump-objectui.sh`
-# calls and the `isEntrypoint` helper it imports, alongside the script under
-# test — mirroring `objectui-changeset-digest.mjs`'s own self-test fixtures
-# (which copy the same trio for the same reason).
-DIGEST_SCRIPT="${SCRIPT_DIR}/objectui-changeset-digest.mjs"
-INVOKED_AS_SCRIPT="${SCRIPT_DIR}/invoked-as.mjs"
+# calls, plus every first-party module that script imports, alongside the script
+# under test — mirroring `objectui-changeset-digest.mjs`'s own self-test
+# fixtures, which stage the same closure for the same reason.
+#
+# ⭐ The module list is DERIVED, not typed (#16421). It was two names here
+# (`objectui-changeset-digest.mjs`, `invoked-as.mjs`) and the same two names in
+# three other places; when the digest script gained one import, this file was the
+# THIRD staging site to go red, and what a reader saw was not an
+# `ERR_MODULE_NOT_FOUND` they could act on: the staged digest died as a
+# subprocess, so `range_walkable` never returned one of its two verdicts and
+# case 5 failed on the refusal's wording instead. (⚠️ `bump-objectui.sh` itself
+# is NOT at fault and is not to be touched for this: it swallows no stderr, and
+# its `WALK_RC` branch already separates a verdict from a no-answer and refuses
+# to offer `--unshallow` for a crash. See #18354 for what IS carded.) The
+# derivation lives in `first-party-closure.mjs`, shared with the JS sites.
+#
+# ⚠️ THE BASENAME IS SPELLED ALONE AND THE DIRECTORY IS INTERPOLATED ONTO IT —
+# the same discipline the declaration above states for CHANGESET_NAME, and for
+# the same machine reason: `dispatch-gates` reads a quoted literal carrying a
+# separator as a DECLARED WATCHED PATH, so writing the repo-relative path as one
+# bare token here gives this gate a path population and CONTRADICTS the
+# `no-path-population` marker above. Measured, not theorised —
+# `check:pm-dispatch-gates`: "no family both DECLARES no path population and
+# names paths anyway (contradicted: check:objectui-bump)". ⛔ Do not tidy this
+# back into a single literal.
+DIGEST_BASENAME='objectui-changeset-digest.mjs'
+REPO_ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DIGEST_ENTRY="scripts/${DIGEST_BASENAME}"
+# The same script, absolute, for the two cases that run it from THIS checkout
+# rather than from a sandbox — those need no staging at all.
+DIGEST_SCRIPT="${REPO_ROOT_DIR}/${DIGEST_ENTRY}"
 
 # Case 5's fixture changeset BASENAME — interpolated into a changeset path
 # everywhere it is used, never spelled as one bare path literal: that path
@@ -123,13 +149,48 @@ new_framework() {
 }
 
 # Same, plus a byte copy of the digest script `bump-objectui.sh` shells out to
-# and the `invoked-as.mjs` helper it imports — needed only by cases that do NOT
-# pass `--no-changeset` and so actually reach the changeset section.
+# and every first-party module that script imports — needed only by cases that
+# do NOT pass `--no-changeset` and so actually reach the changeset section.
+#
+# ⛔ The closure is written to a file and its exit code read on its own line: a
+# `node ... | while read` pipeline would hand this function the exit code of
+# `while`, so a derivation that died would stage NOTHING and look like it worked,
+# which is the failure shape this whole change exists to remove.
 new_framework_with_digest() {
   local d="$1" pin="${2-}"
   new_framework "$d" "$pin"
-  cp "$DIGEST_SCRIPT" "${d}/scripts/objectui-changeset-digest.mjs"
-  cp "$INVOKED_AS_SCRIPT" "${d}/scripts/invoked-as.mjs"
+  local list="${d}/.closure.txt" rel
+  # ⚠️ Each path is emitted with its OWN trailing newline, and the loop below
+  # still reads an unterminated last line. Both halves, because the first time
+  # this was written with `join('\n')` the final path — `first-party-closure.mjs`
+  # itself — was silently dropped by `read`, and the sandbox then failed with the
+  # SAME ERR_MODULE_NOT_FOUND this derivation exists to prevent, from a list that
+  # had named the file correctly.
+  node --input-type=module -e "
+    import { firstPartyModuleClosure } from '${REPO_ROOT_DIR}/scripts/first-party-closure.mjs';
+    for (const rel of firstPartyModuleClosure('${DIGEST_ENTRY}', { root: '${REPO_ROOT_DIR}' })) console.log(rel);
+  " > "$list" 2>"${list}.err"
+  local ec=$?
+  if [[ $ec -ne 0 ]]; then
+    printf 'bump-objectui.selftest: could not derive the digest closure (exit %s)\n' "$ec" >&2
+    cat "${list}.err" >&2
+    return "$ec"
+  fi
+  local staged_count=0
+  while read -r rel || [[ -n "$rel" ]]; do
+    [[ -z "$rel" ]] && continue
+    mkdir -p "${d}/$(dirname "$rel")"
+    cp "${REPO_ROOT_DIR}/${rel}" "${d}/${rel}"
+    staged_count=$((staged_count + 1))
+  done < "$list"
+  # A derivation that came back short stages a sandbox that looks runnable and
+  # is not, so the count is ASSERTED here rather than discovered three cases
+  # later as "the objectui range does not walk".
+  if [[ "$staged_count" -lt 2 ]]; then
+    printf 'bump-objectui.selftest: the digest closure staged only %s file(s) — expected the script and its imports\n' "$staged_count" >&2
+    return 1
+  fi
+  rm -f "$list" "${list}.err"
 }
 
 # A throwaway objectui repo with a REAL changeset commit — commit A (the