@@ -1244,9 +1244,16 @@ function findUpSeeds(src, hereDepth, fileSegs, ownPackageName) {
  * `--self-test` pins the shapes that must keep flagging AND the shapes that must
  * not; an added spelling without an added case is the next silent regression.
  */
-function scanPathExpressions(src, hereDepth, fileSegs = null, ownPackageName = null) {
+export function scanPathExpressions(src, hereDepth, fileSegs = null, ownPackageName = null) {
   const known = new Map();
   const escapes = [];
+  // Every path-argument read, with what its argument resolved to (`null` when
+  // nothing here could read it). This gate judges escapes and needs no more;
+  // `ui/scripts/select-affected-tests.mjs` reads it to attribute a disk-reading
+  // test to the packages it reads, and keeps the test always-on when any entry
+  // is `null` or unnamed -- an unread argument must cost it the attribution,
+  // never pass as "reads nothing" (objectstack#31520).
+  const reads = [];
   const files = new Set();
   const dirs = new Set();
   // Module specifiers this file imports from outside the package, as the
@@ -1308,6 +1315,7 @@ function scanPathExpressions(src, hereDepth, fileSegs = null, ownPackageName = n
     n += 1;
     const first = splitTopLevel(args)[0];
     const info = known.get(first) ?? pathExpression(first, hereDepth, known, fileSegs);
+    reads.push({ fn, info: info ?? null });
     if (DIR_ARG_READS.has(fn) && (!info || info.segs === null)) anonymousDescent = true;
     collect(DIR_ARG_READS.has(fn) ? dirs : files, info);
     // A bare binding here was already judged at its declaration; reporting it a
@@ -1335,7 +1343,7 @@ function scanPathExpressions(src, hereDepth, fileSegs = null, ownPackageName = n
     if (info.segs?.length && !info.vendored) imports.add(info.segs.join('/'));
   }
   const walkRoots = anonymousDescent ? descentRoots(src, hereDepth, fileSegs, known) : new Set();
-  return { escapes, files, dirs, imports, walkRoots };
+  return { escapes, files, dirs, imports, walkRoots, reads };
 }
 
 /**
@@ -3341,6 +3349,63 @@ function selfTest() {
       CO,
     ).includes('scripts/sync-template-versions.mjs'),
   );
+  {
+    // `reads` lists every path-argument read, an unreadable argument included
+    // as `null` -- the selector's fail-closed attribution rests on that entry.
+    const { reads } = scanPathExpressions(
+      "const HERE = dirname(fileURLToPath(import.meta.url));\n" +
+        "readFileSync(join(HERE, '..', 'index.ts'), 'utf8');\n" +
+        'readFileSync(someVariable);',
+      1,
+      CO,
+    );
+    ok(
+      '`reads` names a resolved read and keeps an unreadable one as null (objectstack#31520)',
+      reads.length === 2 &&
+        reads[0].info?.segs?.join('/') === 'packages/create-objectstack/index.ts' &&
+        reads[1].info === null,
+    );
+  }
+  {
+    // The UI test selector attributes a disk-reading test through `reads`
+    // (ui/scripts/select-affected-tests.mjs, `readRadius`). CI's ui filter does
+    // not list this file, so a walker-only edit would skip Test UI; this case
+    // drives the selector's own reading here instead (objectstack#31520). A
+    // child process does the import: the selector imports this module back.
+    const selector = pathToFileURL(join(REPO_ROOT, 'ui', 'scripts', 'select-affected-tests.mjs')).href;
+    const probe = spawnSync(
+      process.execPath,
+      [
+        '--input-type=module',
+        '-e',
+        `const S = await import(${JSON.stringify(selector)});\n` +
+          "const packages = [{ name: '@fx/own', dir: 'packages/own' }, { name: '@fx/other', dir: 'packages/other' }];\n" +
+          "const seed = \"import { readFileSync } from 'node:fs';\\nimport { dirname, join } from 'node:path';\\n" +
+          "import { fileURLToPath } from 'node:url';\\nconst HERE = dirname(fileURLToPath(import.meta.url));\\n\";\n" +
+          "const at = (read) => { const r = S.readRadius({ rel: 'packages/own/src/x.test.ts', source: `${seed}${read};\\n`, " +
+          "packages, prefix: '', walker: S.PATH_WALKER }); return r === null ? null : [...r]; };\n" +
+          'console.log(JSON.stringify({ walker: typeof S.PATH_WALKER, ' +
+          "own: at(\"readFileSync(join(HERE, '..', 'fixtures', 'x.json'))\"), " +
+          "other: at(\"readFileSync(join(HERE, '..', '..', 'other', 'src', 'index.ts'))\"), " +
+          "unread: at('readFileSync(someVariable)') }));",
+      ],
+      { encoding: 'utf8' },
+    );
+    let got = null;
+    try {
+      got = JSON.parse((probe.stdout || '').trim().split('\n').pop());
+    } catch {
+      got = null;
+    }
+    ok(
+      "the UI test selector's readRadius, driven through this walker, bounds an own and a cross-package read and refuses an unread one (objectstack#31520)",
+      probe.status === 0 &&
+        got?.walker === 'function' &&
+        JSON.stringify(got.own) === '["packages/own"]' &&
+        JSON.stringify(got.other) === '["packages/other"]' &&
+        got.unread === null,
+    );
+  }
   ok(
     'reconstructs an ascent-relative literal (metadata-protocol -> the durability gate)',
     named(
 
@@ -12,6 +12,8 @@ import {
   dedupeFilters,
   listWorkspacePackages,
   moduleSpecifiers,
+  PATH_WALKER,
+  PATH_WALKER_FILE,
   outsideTreeReasons,
   packageClosures,
   parseWorkspaceGlobs,
@@ -48,6 +50,15 @@ function fixture(files: Record<string, string>): { root: string; tracked: string
   return { root, tracked: Object.keys(files).sort() };
 }
 
+/** A test source that reads `args` (joined onto its own directory) with `fs`. */
+const reader = (read: string, extraImports = '') =>
+  "import { readFileSync } from 'node:fs';\n" +
+  "import { dirname, join } from 'node:path';\n" +
+  "import { fileURLToPath } from 'node:url';\n" +
+  extraImports +
+  'const HERE = dirname(fileURLToPath(import.meta.url));\n' +
+  `${read};\n`;
+
 const manifest = (name: string, deps: Record<string, string> = {}) =>
   JSON.stringify({ name, version: '0.0.0', dependencies: deps });
 
@@ -107,6 +118,16 @@ function workspace() {
     'packages/c/src/helpers/tree.ts': "import fs from 'node:fs';\nexport const t = fs.existsSync('.');\n",
     'packages/c/src/undeclared.test.ts': "import { a } from '@fx/a';\n",
     'packages/c/src/reach.test.ts': "import { b } from '../../b/src/index';\n",
+    'packages/c/src/own-read.test.ts': reader("readFileSync(join(HERE, '..', 'fixtures', 'x.json'), 'utf8')"),
+    'packages/c/src/other-read.test.ts': reader("readFileSync(join(HERE, '..', '..', 'a', 'src', 'index.ts'), 'utf8')"),
+    'packages/c/src/cwd-read.test.ts': reader("readFileSync(join(process.cwd(), 'x.json'), 'utf8')"),
+    'packages/c/src/var-read.test.ts': reader('const files = [HERE];\nfor (const f of files) readFileSync(f)'),
+    'packages/c/src/aliased-read.test.ts': "import { readFileSync as rf } from 'node:fs';\nrf(new URL('./x.json', import.meta.url));\n",
+    'packages/c/src/ts-read.test.ts': reader("readFileSync(join(HERE, 'x.json'), 'utf8')", "import ts from 'typescript';\n"),
+    'packages/c/src/passed-read.test.ts': reader("readFileSync(join(HERE, 'x.json'), 'utf8');\n[HERE].map(readFileSync)"),
+    'packages/c/src/rebound-read.test.ts': reader(
+      "readFileSync(join(HERE, 'x.json'), 'utf8');\nconst r = readFileSync;\nr('/etc/hosts')",
+    ),
     'packages/c/src/escapes.test.ts': "import '../../../scripts/helper.mjs';\n",
     'packages/heavy-user/package.json': manifest('@fx/heavy-user'),
     'packages/heavy-user/src/heavy.test.tsx': 'export {};\n',
@@ -220,6 +241,56 @@ describe('select-affected-tests — attributed test files (objectstack#31520)',
   });
 });
 
+describe('select-affected-tests — bounded disk readers (objectstack#31520)', () => {
+  // Each `packages/c` reader below reads through `fs`. Only a read the walker
+  // names inside a workspace package frees the test; everything else keeps it
+  // always-on, which is the answer every disk reader had before.
+  const { root, tracked } = workspace();
+  const docsOnly = affected(root, tracked, ['content/page.md']);
+  const why = new Map(docsOnly.alwaysOn.map((a) => [a.file, a.why]));
+
+  it('the walker is loaded here, nested as ui/ of objectstack', () => {
+    expect(typeof PATH_WALKER).toBe('function');
+  });
+
+  it('frees a test whose reads stay in its own package, and selects it with that package', () => {
+    expect(why.has('packages/c/src/own-read.test.ts')).toBe(false);
+    expect(docsOnly.filters.some((f) => f.includes('own-read.test'))).toBe(false);
+    expect(affected(root, tracked, ['packages/c/src/index.ts']).filters).toContain('packages/c/');
+    expect(affected(root, tracked, ['packages/a/src/index.ts']).filters.some((f) => f.includes('own-read.test'))).toBe(false);
+  });
+
+  it('frees a test that reads another package by a named path, and selects it when that package changes', () => {
+    expect(why.has('packages/c/src/other-read.test.ts')).toBe(false);
+    const v = affected(root, tracked, ['packages/a/src/index.ts']);
+    expect(v.filters).toContain('packages/c/src/other-read.test.ts');
+    expect(new Map(v.attributed.map((a) => [a.file, a.via])).get('packages/c/src/other-read.test.ts')).toEqual(['@fx/a']);
+    expect(affected(root, tracked, ['packages/registry/src/index.ts']).filters.some((f) => f.includes('other-read.test'))).toBe(
+      false,
+    );
+  });
+
+  it('keeps a test whose read goes through process.cwd(), an unnamed argument, an aliased import or a disk-reading library', () => {
+    for (const file of ['cwd-read', 'var-read', 'aliased-read', 'ts-read']) {
+      expect(why.get(`packages/c/src/${file}.test.ts`), file).toBe('reads the disk or spawns a process');
+    }
+  });
+
+  it('keeps a test that passes or re-binds a named fs read, even beside a bounded read', () => {
+    for (const file of ['passed-read', 'rebound-read']) {
+      expect(why.get(`packages/c/src/${file}.test.ts`), file).toBe('reads the disk or spawns a process');
+    }
+  });
+
+  it('keeps every disk reader always-on when the walker is absent (a standalone tree)', () => {
+    const v = selectAffectedTests({ root, tracked, changed: ['content/page.md'], walker: null });
+    expect(v.mode).toBe('affected');
+    const standalone = new Map((v as Affected).alwaysOn.map((a) => [a.file, a.why]));
+    expect(standalone.get('packages/c/src/own-read.test.ts')).toBe('reads the disk or spawns a process');
+    expect(standalone.get('packages/c/src/other-read.test.ts')).toBe('reads the disk or spawns a process');
+  });
+});
+
 describe('select-affected-tests — what forces a full run', () => {
   const { root, tracked } = workspace();
 
@@ -435,6 +506,20 @@ describe('select-affected-tests — the live tree', () => {
     expect(heavy.tests.filter((t) => !tracked.has(t))).toEqual([]);
   });
 
+  it('a change to the imported path walker selects what a change to the selector itself does (objectstack#31520)', () => {
+    // The walker lives outside ui/, so a change there arrives as `outside`. It
+    // must keep reaching this file's own tests, or an edit to it could narrow
+    // the selection with nothing here running to notice.
+    const self = 'scripts/__tests__/select-affected-tests.test.ts';
+    const walker = selectAffectedTests({ changed: [], outside: [PATH_WALKER_FILE] });
+    const selector = selectAffectedTests({ changed: ['scripts/select-affected-tests.mjs'] });
+    expect(walker.mode).toBe(selector.mode);
+    if (walker.mode === 'affected' && selector.mode === 'affected') {
+      expect(walker.filters).toEqual(selector.filters);
+      expect(walker.filters).toContain(self);
+    }
+  });
+
   it('reaches a verdict from the command line, and an empty change still selects the always-on set', () => {
     const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'select-affected-cli-')), 'filters.txt');
     tmpRoots.push(path.dirname(out));