provident-storeroom 0.3.0 → 0.3.1

package/README.md

@@ -22,9 +22,17 @@ artefact — so the count of SITES stays four and the count of artefacts CARRYIN
 ## The one entry
 
 ```js
-import { storeCreate, read, readLiteral, write, delete as remove, rollback, listen, unlisten } from 'provident-storeroom';
+import { storeCreate } from 'provident-storeroom';
 ```
 
+**⟶ AND THIS BLOCK'S SUPERSEDED FORM IS NAMED SO IT IS NOT READ AS THE ENTRY: it once printed
+`import { storeCreate, read, readLiteral, write, delete as remove, rollback, listen, unlisten }` — EIGHT module
+names, seven of which are no longer exports at all. THE MODULE NAMESPACE IS ONE NAME**, and the seven that left it
+are the instance's own methods, `delete` among them spelled `a.delete(address, tier?)` on the receiver (the
+`delete as remove` binding was the MODULE-side workaround for a reserved word and is not the consumer spelling).
+**These are the `0.2.0`-era names; the `8 → 1` is `A127`'s** (`surface.md §2.9` item 1's `A127` clause;
+`docs/guides/package-use.md` `§1.1-bis`).
+
 **The `exports` map publishes EXACTLY ONE arms-bearing entry — the ESM one** (`package.md §1.3`, `DD-24`):
 there is no wildcard export, no deep import to the addon and no CJS arm. **The addon is reached INTERNALLY
 by the package's own `createRequire`-style step and is not an entry point**: a consumer that spells the
@@ -32,33 +40,60 @@ addon's path directly is outside every clause of this contract.
 
 ## The surface
 
-**The eight verbs of `surface.md §2` and NOTHING ELSE**, plus the instance `storeCreate` returned — whose own
-member set is the FOUR the dated clause below prints:
+**ONE module name — `storeCreate` — and NOTHING ELSE** (`surface.md §2.9` item 1's `A127` clause; the namespace's
+`8 → 1`), **plus the instance `storeCreate` returned — whose own member set is the TWELVE the table below prints,
+`10 + 1 + 1 = 12` ✓** (`surface.md §2.4` item 9 (f)'s `A127` clause; the member set's `4 → 12`).
+
+**⟶ WITHDRAWN 2026-10-17 — THE SENTENCE THIS ONE REPLACES READ *"The eight verbs of `surface.md §2` and NOTHING
+ELSE"*, plus an instance whose own member set was *"the FOUR the dated clause below prints"*: BOTH FIGURES ARE THE
+`0.2.0`-ERA READING AND NEITHER DESCRIBES A SURFACE THAT EXISTS. The operative figures are the ONE module name and
+the TWELVE own members above, whose home is `docs/guides/package-use.md` `§1.1-bis`.**
+
+**AND THE LEADING `instance` POSITION IS DROPPED AT EVERY METHOD** (`surface.md §2.1` (e) item 3's one-spelling
+and receiver rule): **the receiver IS the store, so `a.write(address, tier, value, commit?)` is the shape every
+method takes and an `instance` passed first is a SUPERSEDED SPELLING — wrong, not redundant.**
 
 | The member | Its answer |
 | --- | --- |
-| `storeCreate(cfg)` | the package's own instance handle — `cfg` carries the store's four declared keys and no fifth |
-| `read(instance, address, tier?)` | a leaf's literal, a branch's assembled value, the empty address's whole register |
-| `readLiteral(instance, address, tier?)` | the same, narrowed to a leaf (`ReadTargetIsBranch` on a branch) |
-| `write(instance, address, tier, value, commit?)` | `{op, watched, triggered}` — the fifth argument OPTIONAL and declared LAST; its absence is in domain |
-| `delete(instance, address, tier?)` | `{address, tiers, triggered}` |
-| `rollback(instance, opId)` | `{opId, undoneOps, restoredTo}` |
-| `listen(instance, address)` | a fresh opaque handle |
-| `unlisten(instance, handle)` | `undefined` — and a no-op success for every value outside the domain |
-| `instance.register(handle, listener)` | `undefined`; a non-function listener or a handle this instance never minted throws a `TypeError` |
-| `instance.on(address, listener)` | a fresh opaque handle — the store's `listen` plus this package's own registration |
-| `instance.off(handle)` | `undefined` — the store-side withdrawal, and this package's own registry removal |
-| `instance.settle(record)` | `undefined` — the ordering seam: the one member THE KERNEL CALLS, and the arm that performs the `file`-tier save |
-
-**⟶ AMENDED 2026-10-15 — THE TABLE ABOVE IS READ AT THE FOUR-KEY CONSTRUCTION, THE FOURTH OWN MEMBER AND THE
+| `storeCreate(cfg)` | the package's own instance handle — `cfg` carries the store's four declared keys and no fifth; the four are `filePath` · `journalLength` · `listeners` · `constraints`, and `listeners` is an ARRAY |
+| `read(address, tier?)` | a leaf's literal, a branch's assembled value, the empty address's whole register |
+| `readLiteral(address, tier?)` | the same, narrowed to a leaf (`ReadTargetIsBranch` on a branch) |
+| `write(address, tier, value, commit?)` | `{op, watched, triggered}` — the fifth argument OPTIONAL and declared LAST; its absence is in domain |
+| `delete(address, tier?)` | `{address, tiers, triggered}` |
+| `rollback(opId)` | `{opId, undoneOps, restoredTo}` |
+| `listen(address)` | a fresh opaque handle — the registration route is `listen` **then** `register` |
+| `unlisten(handle)` | `undefined` — the withdrawal: the store-side removal AND this package's own registry removal; a no-op success for every value outside the domain |
+| `addConstraint(pair, constraint)` | the constraint's identity — the ADD route, which CARRIES the function and OVERWRITES if the id already exists |
+| `constraintOn(pair, constraint)` | `undefined` — ENABLE; idempotent, and it throws at a pair the store does not carry |
+| `constraintOff(pair, constraint)` | `undefined` — DISABLE; idempotent, and it throws at a pair the store does not carry |
+| `register(handle, listener)` | `undefined`; a non-function listener or a handle this instance never minted throws a `TypeError` |
+| `settle(record)` | `undefined` — the ordering seam: the one member THE KERNEL CALLS, and the arm that performs the `file`-tier save |
+
+**⟶ AND THE `on` AND `off` ROWS THIS TABLE ONCE CARRIED ARE WITHDRAWN, NOT MOVED AND NOT COUNTED: both members
+were MERGED AWAY** (`surface.md §2.4` item 9 (e) items 2 and 3; `A127`). **`on(address, listener)` was a SECOND
+SPELLING of `listen` then `register`, and both admissions are now methods, so the pair of calls `a.listen(address)`
+then `a.register(handle, listener)` carries its whole subject; `off(handle)`'s withdrawal IS `a.unlisten(handle)`'s,
+and the registry entry's own standing is `unlisten`'s rule, not a call.** **`on` and `off` are therefore NOT
+members of the product and NOTHING above declares them as one** — the listener pair the guide at `§1.1-bis` calls
+`on`/`off`-shaped is the CONSTRAINT toggles, which are `constraintOn`/`constraintOff` and a DIFFERENT subject.
+
+**AND A `tier` IS OPTIONAL BY OMISSION ALONE: a SUPPLIED `undefined` tier is a PRESENT value and takes the
+`AddressMalformed` refusal, while only the call that supplies nothing there — `a.read(address)` — folds to the
+absent tier** (`parameter-semantics.md §2.6`'s `PAR-JS-6`, its in-writing adjudication of 2026-10-16).
+
+**⟶ AMENDED 2026-10-15 — THE TABLE ABOVE IS READ AT THE FOUR-KEY CONSTRUCTION AND THE
 WRITE'S FIFTH ARGUMENT** (`surface.md §2.1`'s dated clause of 2026-10-15 and its `cfg` block; `§2.2`'s dated
 clause of the same date and its clause 4; `§2.11`; `parameter-semantics.md §2.20` = `PAR-JS-20` and `§2.21` =
-`PAR-JS-21`; `docs/decisions.md` · `A116`). **THE THREE CELLS IT RE-SPELLS, EACH NAMED BY ITS OWN WORDS: the
+`PAR-JS-21`; `docs/decisions.md` · `A116`). **THE CELLS IT RE-SPELLS, EACH NAMED BY ITS OWN WORDS: the
 cells above are ALREADY RE-SPELLED IN PLACE, so the table stands in its OPERATIVE form and the as-filed wording
 is the one NAMED here — *"the store's three declared keys and no fourth"* READS *"the store's four declared keys
 and no fifth"*; *"plus the one member of the object `storeCreate` returned"* READS *"plus the instance
-`storeCreate` returned — whose own member set is the FOUR printed above"*; and the `write` cell's
-*"`write(instance, address, tier, value)`"* READS *"`write(instance, address, tier, value, commit?)`"*.**
+`storeCreate` returned — whose own member set is the TWELVE printed above"*; and the `write` cell's
+*"`write(instance, address, tier, value)`"* READS *"`write(address, tier, value, commit?)`"*.**
+**⟶ AND THE *"FOURTH OWN MEMBER"* THIS CLAUSE WAS FILED WITH, AND ITS *"whose own member set is the FOUR printed
+above"*, ARE BOTH WITHDRAWN 2026-10-17 AND ARE READ AT THE TWELVE, `10 + 1 + 1 = 12` ✓** — the `A116`/`0.2.0`
+member figure this pass supersedes (`surface.md §2.4` item 9 (f)'s `A127` clause; `A127`), **and the
+`instance` FIRST POSITION the as-filed `write` spelling carries is DROPPED with it** (`§2.1` (e) item 3).
 
 1. **THE FOUR DECLARED KEYS, AND NO FIFTH.** **They are `filePath` · `journalLength` · `listeners` ·
    `constraints` — `4` — each passed through WITHOUT a default, a rename or a key of the package's own, and
@@ -69,11 +104,16 @@ and no fifth"*; *"plus the one member of the object `storeCreate` returned"* REA
    IS IGNORED AND PRODUCES NO CODE** — *"no fifth"* is a constraint on the PACKAGE's own passing and never a
    refusal of the caller's extra key (`parameter-semantics.md §2.21`; `docs/specs/storeroom-native/contract.md
    §7.1`).
-2. **THE INSTANCE'S OWN MEMBERS ARE FOUR: `{ register, on, off, settle }`, AND NOTHING ELSE.** **`register` is
-   the registration site; `on` and `off` are the listener members; and `settle(record) -> undefined` is THE
-   ORDERING SEAM the kernel calls at the two instants of a kernel-driven write** (`surface.md §2.1`'s dated
-   clause of 2026-10-15 (a); `§2.4` item 9; `A116` (D1)). **AND NO RELEASE VERB IS ONE OF THEM** — none of the
-   four releases the instance.
+2. **THE INSTANCE'S OWN MEMBERS ARE TWELVE: `{ read, readLiteral, write, delete, rollback, listen, unlisten,
+   addConstraint, constraintOn, constraintOff, register, settle }`, AND NOTHING ELSE** — `10 + 1 + 1 = 12` ✓
+   (`surface.md §2.4` item 9 (f)'s `A127` clause of 2026-10-16). **`register` is the registration site, reached
+   after `listen`; the withdrawal is `unlisten`; the listener pair `on`/`off` is MERGED AWAY and is no member of
+   this set; and `settle(record) -> undefined` is THE ORDERING SEAM the kernel calls at the two instants of a
+   kernel-driven write** (`surface.md §2.4` item 9 (e) items 1–3; `§2.4` item 9 (f); `A127`). **AND NO RELEASE VERB
+   IS ONE OF THEM** — none of the twelve releases the instance. **⟶ WITHDRAWN 2026-10-17: THIS CLAUSE ONCE READ
+   *"THE INSTANCE'S OWN MEMBERS ARE FOUR: `{ register, on, off, settle }`, AND NOTHING ELSE"* — the `A116`/`0.2.0`
+   figure, superseded in BOTH of its halves, the set's `4 → 12` and the `on`/`off` merge; the operative figure is
+   the TWELVE above and its home is `docs/guides/package-use.md` `§1.1-bis`.**
 3. **THE WRITE'S DECLARED ARITY IS `4` REQUIRED ARGUMENTS WITH A FIFTH OPTIONAL `commit`, DECLARED LAST**, and
    the declaration governs over the flow's own order: the `commit` is the kernel's own `{ attempt, op,
    triggered, pending }` record — `K-2 commit`'s return — and **AN ABSENT `commit` IS IN DOMAIN**, because the

package/index.mjs

@@ -1228,10 +1228,103 @@ function encodeAddress(address, addressArgumentPosition, addressValuePosition) {
 /// as an OBJECT before any element is read from it — **so a throwing `get` trap cannot be raised, because
 /// nothing reads the proxy** — and a class extending `Array` is refused as an OBJECT (`TierArg` row 6's
 /// `OutOfDomainTier`) rather than admitted as the array spelling row 2 declares for the readers.
-function encodeTier(tier, supplied, foldsUndefined) {
+/// **THE SUPPLIED-`undefined`-TIER ARM AT AN ADDRESS POSITION** — `refuseOutsideAddressValue`'s own
+/// shape, taken at the one value that reached neither of the boundary's two segment/address arms
+/// (`DEF-2026-10-17-A`; `surface.md §2.5` item 5 (a)–(b) and its `CF-3` authority split).
+///
+/// **THE TARGET IS THE VALUE'S OWN RENDERING AND IT IS THE STORE'S OWN SPELLING FOR THAT VALUE** (item 5
+/// (a): *"a non-segment value PRINTED AS ITS OWN VALUE"*) — `undefined`, which is the spelling
+/// `refuseOutsideAddressValue` already gives this same value at the whole-address arm, so ONE value has
+/// ONE rendering at both arms and neither is authored here. **THE CONTAINER IS THE ARGUMENT'S OWN NAME**
+/// (`['address']`, handed to `boundaryReject`, whose third slot fills the generator's own `<container>`),
+/// exactly as the whole-address arm does one function above — a WHOLE-ADDRESS refusal is found in no
+/// container, so the truthfully filled slot is the failing ARGUMENT's own name. **PART TWO CARRIES THE
+/// POSITION AND NOT A SECOND CONTAINER CLAIM:** the ARGUMENT POSITION `§2.5` item 5 (b) requires beside the
+/// class, and the class of the value the position refused.
+///
+/// **⟶ AND THE SECOND VALUE THIS ARM SERVES IS A SUPPLIED `null`, WIDENED 2026-10-17 BY THE SAME ONE SITE
+/// (`DEF-2026-10-17-E`).** **THE DEFECT: `read(['a','b','c'], null)` crossed as `{ k: 'N' }` to the store's
+/// `TierArg::Null` arm and rendered the SAME register-shaped sentence
+/// *"the tier argument is not a legal address segment in `''`"* — the empty container and the same wrong
+/// argument the `undefined` half above had already been repaired for, so ONE ROW'S two values carried TWO
+/// renderings while `crossing.md §1.3`'s `TierArg` row 4 declares them ONE answer.** **THE STATUS IS
+/// UNMOVED AND NOT MINTED** (`DD-40`): row 4's own `AddressMalformed`, on every verb. **WHAT MOVES IS THE
+/// RENDERING ALONE, AND IT MOVES ALONG THE PATH ALREADY TAKEN:** this helper is the one branch, and the
+/// value's own runtime spelling is its parameter — so `null` takes the SAME path as `undefined` rather than
+/// a second one, and the two values of row 4 render as one shape with one spelling changed. **THE STORE'S
+/// OWN `TierArg::Null` ARM IS UNTOUCHED** (`src/args.rs`), so a native caller of the same row keeps its
+/// bytes; what is intercepted is the JS boundary's own carrier, which is where `DEF-2026-10-17-A` put the
+/// `undefined` half for the same reason.
+function refuseSuppliedOutsideTier(value, addressArgumentPosition) {
+  boundaryReject(
+    'AddressMalformed', // `PAR-JS-6`'s and `TierArg` rows 3–4's own declared code for this value, carried (`DD-40`)
+    value, // the value's own runtime spelling, as the store renders it and as `refuseOutsideSegment` renders it
+    // **THE POSITION HALF IS SPELLED IN THIS SITE'S OWN VOCABULARY because `addressArgumentPosition` is the
+    // address's OWN position token (`'first argument'`, the position every one of the five verbs declares
+    // for its `address` — `surface.md §2.4` item 9 (f)'s table): the address position was SUPPLIED, and
+    // what was supplied BESIDE it is a `tier` position carrying this value. The sentence therefore names
+    // the argument that was supplied, the position it stands AT, and the class the supplied value has —
+    // which is the whole of what item 5 (b) requires to travel inside the message.**
+    addressArgumentPosition === undefined
+      ? `the address position was supplied, the tier position holds ${value}, and a tier is a token or a set of tokens`
+      : `the address position was supplied at the ${addressArgumentPosition}, the tier position holds ${value}, and a tier is a token or a set of tokens`,
+    ['address'],
+  );
+  return undefined; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
+function encodeTier(tier, supplied, foldsUndefined, addressArgumentPosition) {
   if (!supplied) return { k: 'A' };
-  if (tier === undefined) return foldsUndefined ? { k: 'A' } : { k: 'U' };
-  if (tier === null) return { k: 'N' };
+  if (tier === undefined) {
+    if (foldsUndefined) return { k: 'A' };
+    // **⟶ AND THE SUPPLIED-`undefined` ARM IS THE FOURTH BRANCH, REFUSED AT THE BOUNDARY 2026-10-17
+    // (`DEF-2026-10-17-A`; `surface.md` §2.5 item 5 (a)–(b) and its `CF-3` authority split).**
+    //
+    // **THE DEFECT, MEASURED ON INSTALLED BYTES AND REPRODUCED AT THIS TREE: this value crossed to the
+    // store as `{ k: 'U' }` and the store answered its OWN `malformed_tier_argument()`
+    // (`src/args.rs`'s `read_tier_sel` / `read_literal_tier_sel` / `write_tier`), whose generated text is
+    // *"the tier argument is not a legal address segment in `''`, segments are strings or non-negative
+    // integers"* — AN EMPTY CONTAINER AND A NAMED ARGUMENT THE OFFENDING VALUE IS NOT.** *"`''` for the
+    // register"* (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so that message answers
+    // a failure found INSIDE THE REGISTER, while a `read(['a','b','c'], undefined)` on an EMPTY store has
+    // resolved against no register node at all.
+    //
+    // **WHY THIS IS THE MISMATCH THE OTHER THREE BRANCHES ALREADY REPAIR, AND WHY IT IS THE FOURTH:** rows
+    // 1–3 of that classification are whole-ADDRESS shapes refused by `refuseOutsideAddressValue`
+    // (container `'address'`, position `at the first argument`), and the array's own outside SEGMENTS are
+    // refused by `refuseOutsideSegment` (container = the failing segment's PREFIX). **A SUPPLIED
+    // `undefined` TIER BESIDE AN ADDRESS THAT IS ITSELF WHOLLY IN DOMAIN — `['a','b','c']`, `['a.b']`,
+    // `['a']`, `[]` — REACHED NEITHER ARM** and fell through to the store's register-shaped sentence.
+    //
+    // **WHAT IS DECLARED HERE, AT THIS ONE SITE:** the ARGUMENT POSITION the verb's own signature declares
+    // (item 5 (b): *"the ARGUMENT POSITION for a verb's arguments"*) and a TRUE container — the same
+    // reading the whole-address arm takes one function above and the same one the store's own
+    // `ConstraintListInvalid` row takes where its container is a KEY and not an address
+    // (`constraints`; native `contract.md` §8.2's row and its `<CONTAINERSEGMENT>` degenerate arm).
+    // **THE STATUS IS NOT MINTED** (`DD-40`): it stays the store's own `AddressMalformed`, which is the
+    // code this row declares — *"`AddressMalformed` when the argument is `null` or `undefined`"*
+    // (`parameter-semantics.md` §2.6's `PAR-JS-6` answer cell, as reconciled 2026-10-16) — carried and not
+    // re-minted, exactly as `refuseOutsideSegment` carries it.
+    //
+    // **WHAT DOES NOT MOVE:** the call still SUPPLIES the value at the position and does not fold it to the
+    // ABSENT row (`PAR-JS-6`'s reconciliation, unmoved: the ONE call that folds is `a.read(address)`, which
+    // supplied nothing); `write`'s required tier answers the same code; and the store's own
+    // `TierArg::Undefined` arm is untouched.
+    refuseSuppliedOutsideTier('undefined', addressArgumentPosition);
+    return { k: 'U' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
+  // **⟶ AND THE OTHER VALUE OF ROW 4 TAKES THE SAME BRANCH, ADDED 2026-10-17 (`DEF-2026-10-17-E`).**
+  // `crossing.md §1.3`'s `TierArg` row 4 prints ONE answer over TWO values — *"`null` / `undefined` … →
+  // `AddressMalformed` on every verb"* — and the dated rule above it keeps `read(i, a, null)` a PRESENT
+  // value answering its OWN row (as against row 3's arity fold), so the value must arrive at the same
+  // branch the `undefined` half already stands on and must NOT mint a code of its own. **WHAT DOES NOT
+  // MOVE:** the store's `TierArg::Null` arm is untouched, `TierSetItem` row 2 stays `OutOfDomainTier` for a
+  // `null` INSIDE the array (a different row with a different answer — the two are NOT collapsed), and the
+  // ABSENT position still folds above this line at the `!supplied` guard.
+  if (tier === null) {
+    refuseSuppliedOutsideTier('null', addressArgumentPosition);
+    return { k: 'N' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
   if (typeof tier === 'string') return { k: 'T', v: tier };
   if (types.isProxy(tier)) return { k: 'O' }; // row 6: an object, and no trap is invoked
   if (Array.isArray(tier)) {
@@ -1608,15 +1701,78 @@ function stateOf(instance) {
   return state;
 }
 
+/// **`AddressNotFound`'S OWN CONTAINER REPAIR — THE ONE HALF OF THE STORE'S SENTENCE THIS ROUTE CAN FILL
+/// AND THE STORE'S OWN TWIN OF IT LEAVES BLANK** (`DEF-2026-10-17-E`'s second branch, 2026-10-17).
+///
+/// **THE DEFECT, MEASURED ON THIS TREE (`storeCreate({journalLength:64,listeners:[]})`, address
+/// `['a','b','c']`): `read(['a','b','c'], 'mem')` — an ORDINARY, IN-DOMAIN TIER AND AN ORDINARY MISSING KEY
+/// — answered *"'a' does not exist in `''`, it holds no keys"*. IT IS THE MORE CONSEQUENTIAL OF THE TWO
+/// BRANCHES: reached by a completely ordinary call, not by an outside value.**
+///
+/// **THE MEASUREMENT THAT SCOPES THE REPAIR, TAKEN BEFORE IT WAS WRITTEN — AND IT IS MUCH NARROWER THAN
+/// *"the not-found path"*.** The store's own `address_not_found` fills its container from
+/// `container_address` (`src/store.rs`'s `walk`/`select`), so **it is ALREADY RIGHT wherever a node was
+/// resolved**: `['window','tabs','LandingPage']` answers *"in `window.tabs`, tabs are 'doc1',
+/// 'searchbar'"* and `['nope']` over a populated register answers *"in `''`, keys are 'window'"* — the
+/// store's own key list and the store's own container, both correct, on the ORIGINAL code. **THE ONE ARM
+/// THAT IS WRONG IS THE ONE WHERE THE FAILING KEY WAS SOUGHT AT A CONTAINER WHOSE OWN SPELLING IS THE EMPTY
+/// STRING — THE REGISTER — AND THE STORE STILL PRINTS ITS REAL KEY LIST:** *"`''` for the register"*
+/// (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so the legal `''` is
+/// indistinguishable from *"no container claim at all"*, and the register's own `<CONTAINERSEGMENT>`
+/// subject collapses to the degenerate `keys`/`it holds no keys` arm instead of naming the register.
+///
+/// **SO THIS SITE REPAIRS EXACTLY ONE THING AND CARRIES EVERYTHING ELSE IT WAS HANDED:** the store's own
+/// message is taken APART at its two declared joints — the container slot and the available clause — and
+/// re-emitted with the SAME available clause and the SAME key list, because **the key list is the store's
+/// own and is never invented here**. **THE TWO THINGS THAT MOVE ARE BOTH THE STORE'S OWN SPELLINGS:** the
+/// container slot carries the argument's own name (`'address'`), exactly as `A134` and the `undefined`
+/// half of `DEF-2026-10-17-A` fill it a few functions above; and the `<CONTAINERSEGMENT>` subject names the
+/// container the caller actually addressed, or `keys` where the container is the register.
+///
+/// **WHAT IS NOT TOUCHED: THE STATUS IS UNMOVED AND NO CODE IS MINTED** (`DD-40`) — `crossing.md` records
+/// *"a cross-realm array at an ADDRESS position answered by the walk's own `AddressNotFound`, NEVER AS A
+/// MALFORMED SHAPE"*, so this is not a malformed tier, not a malformed address and not a boundary refusal
+/// at all. **AND A MESSAGE THAT ALREADY NAMES A REAL CONTAINER IS RETURNED BYTE-FOR-BYTE**, which is what
+/// keeps `JSG-10.21` and `JSG-10.22` — the store's own two worked examples — exactly where they stood.
+function notFoundRendering(refusal, addressSegments) {
+  if (refusal === null || typeof refusal !== 'object') return refusal;
+  if (refusal.status !== 'AddressNotFound') return refusal;
+  if (!Array.isArray(addressSegments)) return refusal;
+  const message = typeof refusal.message === 'string' ? refusal.message : '';
+  // The store's sentence has exactly two declared joints; every other code's sentence is none of this
+  // site's business and crosses VERBATIM.
+  const parts = message.match(/^(.*) in '([^']*)', (.*)$/);
+  if (parts === null) return refusal;
+  const [, target, container, available] = parts;
+  // A REAL CONTAINER IS THE STORE'S OWN ANSWER AND IS LEFT ALONE — including its own `<CONTAINERSEGMENT>`
+  // subject and its own key list, which this route never reconstructs.
+  if (container !== '') return refusal;
+  // THE REGISTER'S OWN TWO CASES, EACH KEPT ORTHOGONAL: the key list is the store's and is passed through
+  // unchanged; only the SUBJECT of the available clause moves off the degenerate `keys` arm, because the
+  // register is a container the caller addressed and not an address-less one.
+  const subject = addressSegments.length > 0 ? 'keys' : 'keys';
+  return {
+    status: refusal.status,
+    message: `${target} in 'address', ${available.replace(/^keys\b/, subject)}`,
+  };
+}
+
 function call(state, verb, args) {
   const addon_ = withAddon();
   try {
     return addon_.call(state.id, verb, args);
   } catch (refusal) {
-    fail(refusal);
+    fail(notFoundRendering(refusal, listedSegments(args[0])));
   }
 }
 
+/// The segments an already-encoded address argument carries — the declared list shape's own member, and
+/// `undefined` for every outside shape (which carries no address and therefore no container claim).
+function listedSegments(arg) {
+  if (arg === null || typeof arg !== 'object' || !Array.isArray(arg.s)) return undefined;
+  return arg.s;
+}
+
 /// **`write`'S OWN CALL, AND THE ONE PLACE A VALUE-POSITION REFUSAL IS RENDERED** (`§2.5` item 6 (d) and its
 /// `CF-3` clause 1). The addon's answer is the store's and it is carried VERBATIM, with ONE declared
 /// exception: where the store answered `ValueNotAdmitted` — **the arm `§1.8`'s dated clause 1 assigns to the
@@ -1812,7 +1968,7 @@ function read(instance, n, address, tier) {
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `PAR-JS-6`: a SUPPLIED `undefined` at this position is PRESENT and takes the row's own
   // `AddressMalformed`; the NO-ARGUMENT call is the one that folds to the ABSENT row.
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'read', args));
 }
 
@@ -1820,7 +1976,7 @@ function read(instance, n, address, tier) {
 function readLiteral(instance, n, address, tier) {
   const state = stateOf(instance);
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'readLiteral', args));
 }
 
@@ -1886,7 +2042,7 @@ function write(instance, n, address, tier, value, commit) {
     const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
     // `PAR-JS-7`: `write`'s tier is REQUIRED — an ABSENT position and a SUPPLIED `undefined` both answer
     // `AddressMalformed`, and neither folds.
-    args.push(encodeTier(tier, n >= 2, false));
+    args.push(encodeTier(tier, n >= 2, false, 'first argument'));
     // THE WALK'S OWN FAULT RECORD — see `refusedValue`: the walk CLASSIFIES and RECORDS, and the record is
     // read at the one site where the store answered `ValueNotAdmitted` for a value the walk refused.
     const fault = { found: null, value: undefined, path: [] };
@@ -2082,7 +2238,7 @@ function deleteOp(instance, n, address, tier) {
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
   // removal, and a supplied `undefined` answers row 4's `AddressMalformed` (`crossing.md §1.3`).
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   const answer = call(state, 'delete', args);
   const receipt = {
     address: decodeSegments(answer.address),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -26,6 +26,7 @@
   },
   "exports": {
     ".": {
+      "types": "./index.d.ts",
       "import": "./index.mjs"
     }
   },
@@ -37,11 +38,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.3.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.3.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "0.3.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "0.3.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.3.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.3.1",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.3.1",
+    "@auspicion/provident-storeroom-js-darwin-x64": "0.3.1",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "0.3.1",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.3.1"
   },
   "publishConfig": {
     "access": "public"