fix(ranker): scope a region to the file that defines its handler (M1b 12.4)

A route-registration module registers handlers that other modules define.
app/routes/index.js requires seven handler modules and defines none, yet regions
there were scoped to handleContributionsUpdate and its siblings. The graph rightly
held no such method, so every question in those regions was unresolvable: 138
across six families on that one repository.

The entry record still names the handler. The authorization question is which
middleware guards which handler, and that is cross-file by nature. It now also
records whether the file defines what it names, and a region built from an entry
that does not is scoped to the file instead of to a method the file lacks. The
handler's own module still gets its function-scoped region, so nothing is lost.

My first attempt changed the mapper to stop naming cross-file handlers at all. An
existing control caught it by asserting that a multi-line registration names the
handler its middleware guards, which is exactly the attribution the authorization
family needs. The evidence was against me and the fix belonged one layer up, in
region construction.

1,407 tests passed, nine skipped.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_model_regions.py

@@ -272,3 +272,31 @@ def test_an_inferred_public_endpoint_keeps_the_obligation() -> None:
     handler = next(r for r in regions if r.function == "handler")
 
     assert "access_control" in handler.families
+
+
+def test_a_route_registered_but_not_defined_here_is_scoped_to_its_file():
+    """12.4: a registration module names handlers other modules define; the graph holds none of them."""
+    from types import SimpleNamespace
+
+    from openultrasast.model.regions import regions_for
+
+    target = SimpleNamespace(path="app/routes/index.js", language="javascript")
+    registered = SimpleNamespace(
+        path="app/routes/index.js",
+        function_name="handleContributionsUpdate",
+        access_level="public",
+        defines_handler=False,
+    )
+    defined = SimpleNamespace(
+        path="app/routes/contributions.js",
+        function_name="handleContributionsUpdate",
+        access_level="public",
+        defines_handler=True,
+    )
+    other = SimpleNamespace(path="app/routes/contributions.js", language="javascript")
+    scoped = {(region.path, region.function) for region in regions_for([registered, defined], [target, other])}
+    # The registering file asks about itself, not about a method it does not hold.
+    assert ("app/routes/index.js", None) in scoped
+    assert not any(path == "app/routes/index.js" and function for path, function in scoped)
+    # The module that defines it still gets the function-scoped region.
+    assert ("app/routes/contributions.js", "handleContributionsUpdate") in scoped