Make the two gates say where the tree name came from

Last tick I fixed a dead config read in check-composite-srcs and
check-nested-token, and logged the lesson as an anti-pattern whose advice was:
make the successful path observable — print what was READ, not just what was
used. I did not take my own advice, so this applies it.

Both gates printed "checked against public/doxa-maps/" whether the name came
from the build config or from the hardcoded fallback. Those two states were
indistinguishable in the output, which is precisely why a permanently-failing
read survived unnoticed: nobody was ever going to rename the tree, so the only
thing that could have exposed it was the output, and the output said nothing.

They now print the source. A green run reads "(tree name from
vite.doxa-maps-build-config.json)"; with the read broken it reads "(tree name
from built-in default (build config unreadable))". Negative-tested by pointing
the read at a nonexistent filename and confirming the line changes, then
restoring and confirming it changes back.

Also corrects a comment I got wrong yesterday. The note explaining the bug said
the gate "said vite.doxa-maps-build-config.json — the pre-rename project name",
which is the NEW name; my sed had rewritten the string inside the prose that
described the OLD one. It now names vite.1040-maps-build-config.json, which is
what was actually there. A correction note that misstates what it corrects is
worse than none, because the next reader takes it as the record.

Six gates pass.

internal/check-composite-srcs.mjs

@@ -39,17 +39,24 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 // The output tree name comes from the build config, the same source generate-tree uses. Defaulting
 // silently would make this gate check a directory the build never writes.
 //
-// ★ THE FILENAME WAS STALE AND THE READ NEVER RAN (fixed 2026-09-23). This said
-// vite.doxa-maps-build-config.json — the pre-rename project name. That file does not exist, so the
+// ★ THE FILENAME WAS STALE AND THE READ NEVER RAN (fixed 2026-09-23). This named
+// `vite.1040-maps-build-config.json`, the PRE-RENAME project name, and no such file exists — so the
 // try ALWAYS threw, the catch ALWAYS fired, and treeName was ALWAYS the hardcoded default. The gate
-// has been correct purely because the default happens to equal the config's current name.
+// was correct only because that default happens to equal the config's current name.
 // Rename the tree in the build config and this gate would have checked a directory the build never
 // writes, then SKIPped with "an absent tree is not evidence either way" — silent, delayed, and
 // exactly the outcome the comment above was written to prevent.
+//
+// ★ AND THE SOURCE IS NOW REPORTED, not just used. A dead read is invisible when only the RESULT is
+// printed: "checked against public/doxa-maps/" looked identical whether the name came from the
+// config or from the fallback. Printing WHICH means a future regression shows up in normal output
+// instead of waiting for a rename to expose it.
 let treeName = 'doxa-maps'
+let treeNameSource = 'built-in default (build config unreadable)'
 try {
   const cfg = JSON.parse(readFileSync(join(ROOT, 'vite.doxa-maps-build-config.json'), 'utf8'))
-  if (cfg?.name) treeName = cfg.name
+  if (cfg?.name) { treeName = cfg.name; treeNameSource = 'vite.doxa-maps-build-config.json' }
+  else treeNameSource = 'built-in default (config has no `name`)'
 } catch { /* fall through to the default */ }
 
 const TREE = join(ROOT, 'public', treeName)
@@ -187,7 +194,7 @@ for (const bundle of bundles) {
 }
 
 console.log(`COMPOSITE-SRCS: ${composites} composite file(s), ${checked} nested reference(s) checked ` +
-            `against public/${treeName}/.`)
+            `against public/${treeName}/ (tree name from ${treeNameSource}).`)
 
 // Vacuous guard: "0 composites" must never read as "0 problems" — this repo ships several.
 const MIN_COMPOSITES = 2

internal/check-nested-token-delivery.mjs

@@ -40,10 +40,18 @@ import { fileURLToPath } from 'node:url'
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 
+// ★ REPORT WHERE THE TREE NAME CAME FROM, not just what it is (2026-09-23).
+// This read named `vite.1040-maps-build-config.json` — the PRE-RENAME project name, a file that
+// does not exist — so the try always threw and treeName was always the hardcoded default. It was
+// correct only because the default happens to equal the config's current name. A dead read is
+// INVISIBLE when only the result is printed, so the source is now part of the output: a future
+// regression shows up on every run instead of waiting for a tree rename to expose it.
 let treeName = 'doxa-maps'
+let treeNameSource = 'built-in default (build config unreadable)'
 try {
   const cfg = JSON.parse(readFileSync(join(ROOT, 'vite.doxa-maps-build-config.json'), 'utf8'))
-  if (cfg?.name) treeName = cfg.name
+  if (cfg?.name) { treeName = cfg.name; treeNameSource = 'vite.doxa-maps-build-config.json' }
+  else treeNameSource = 'built-in default (config has no `name`)'
 } catch { /* default */ }
 
 const TREE = join(ROOT, 'public', treeName)
@@ -141,6 +149,7 @@ if (missing.length || inBundles.length) {
   process.exit(1)
 }
 
+console.log(`NESTED-TOKEN: tree public/${treeName}/ (name from ${treeNameSource}).`)
 console.log('NESTED-TOKEN: PASS — every shipped leaf carries its own token, and no bundle does.')
 console.log('  This is DELIVERY only. It does not prove a basemap paints: that needs a real GPU and')
 console.log('  a token whose URL restrictions allow the serving host (see verify:map-paint).')