check_nonlocal covers nothing when its four inner functions all move, and its OK line names no coverage #2047

Measured on e3bacff2. scripts/check_nonlocal.py verifies the nonlocal declarations of the inner functions inside interactive, and it refuses cleanly when its outer anchor is gone:

ERROR: could not find `interactive` function in app.py        (rc 2)

— the 2026-09-11 worktree defect, where the main checkout's copy answered OK about a worktree whose interactive had been renamed away. But the same absence one level in is silent. An app.py whose interactive holds none of the four guarded functions (handle_key, read_server, _on_sigwinch, _run_elapsed_timer):

$ python3 -c "... check_nonlocal('$T/app.py')"     # app.py: "async def interactive():\n    x = 1\n"
rc = 0, stdout:
OK: nonlocal integrity check passed

inner_fns is empty, the loop never runs, exit_code stays 0 and the guard reports a clean reading of a set with no members. That is the family's rule — "an empty tree is not a clean reading", issue #1872 — and this guard is the one file in scripts/ whose whole subject is those functions: the docstring's own incident is "every variable assigned in interactive and also accessed in handle_key … missing nonlocal", so with handle_key renamed out of interactive the guard covers nothing while its verdict is byte-identical to a correct run's.

Second, smaller silence from the same shape. The OK line names none of what it read:

OK: nonlocal integrity check passed

All four are present in this checkout today (derived from emrg/client/app.py's AST), so the line is a claim about four functions with the count left off. A rename that moves one of them out of interactive shrinks the check's coverage while the output stays byte-identical — the same "a reading that does not name its coverage reads as if it were complete" defect the memory-index summary carried (#2035/#2036).

Fix (PR follows):

• an interactive holding none of the four refuses with rc 2, naming all four and the reason (the sibling of the existing interactive-missing branch), so the empty subject is never a pass; and
• the OK line names which of the four were checked, so a partial shrink is visible rather than silent.

A third reading is deliberately not added: which individual names must exist. read_server/_on_sigwinch/_run_elapsed_timer are treated as if-present by the code and the repo may legitimately reshape them, so this names the coverage and refuses only on the empty set — refusing more would invent a policy the file does not state.