provident-storeroom 0.3.0 → 0.4.0

package/index.mjs

@@ -402,11 +402,84 @@ function addonLoadMessage() {
 }
 
 /// `surface.md §2.5`: **THE SINGLE FAILURE FORM** — a THROWN plain object carrying EXACTLY
-/// `{status, message}` and nothing else. **The status and the message are the store's own and are carried
-/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the two-member form out of the refusal
-/// the addon threw and mints no code of its own, authors no message of its own and adds no third member.
-function fail(refusal) {
-  throw { status: refusal.status, message: refusal.message };
+/// `{status, message, log}`. **The status and the message are the store's own and are carried
+/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the form out of the refusal the addon
+/// threw and mints no code of its own and authors no message of its own.
+///
+/// **⟶ AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16 — `surface.md §2.5` ITEM 4, THE ARCHITECT'S
+/// RULING OF THAT DATE: *"`log` IS PRESENT ON EVERY FAILURE THIS SURFACE THROWS, AND `[]` IS ITS DECLARED
+/// VALUE WHERE THE FAILURE'S CAUSE HAS NO ATTEMPT AT ALL."*** **The three-member member set is FLAT ACROSS
+/// ARMS and not conditional:** a `read`/`readLiteral`/`delete`/`rollback` store refusal with no attempt
+/// live, the construction's own `cfg`-side refusals, `a.register`'s refusal and the constraint methods'
+/// `TypeError` all carry `log: []` — **the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry** — while every failure whose attempt exists carries that attempt's own entries
+/// (`§2.5` items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date). **AND WHERE A STORE ACT
+/// PRODUCED IT, THE STORE'S `status` AND `message` ARE PRESERVED BYTE-FOR-BYTE AND `log` IS ATTACHED BESIDE
+/// THEM — nothing is converted, a member is added** (`§2.5` item 10 (ii); `fail-surface.md §1.2`'s
+/// *"the kernel NEVER CONVERTS ONE CHANNEL'S FAILURE INTO THE OTHER'S FORM"* stands whole).
+///
+/// **THE `log` MEMBER IS AN ORDINARY OWN ENUMERABLE DATA MEMBER** — written with the object literal below,
+/// **not `Object.defineProperty`, not a getter, not on a prototype and not behind a `Symbol`** — so
+/// `Object.keys(caught)` reads exactly `["log","message","status"]` and its length is `3` on every arm
+/// (`§2.5` item 9). **IT IS NOT `defineProperty`'D BECAUSE A MEMBER THAT IS NOT ENUMERABLE IS NOT A MEMBER
+/// A CANONICAL CENSUS CAN SEE**, and it is not a getter because a client reads a list and not a call.
+///
+/// **⟶ AND ITS TWO STORE MEMBERS ARE READ OFF THE STORE'S OWN REFUSAL AND OFF NOTHING ELSE — CORRECTED
+/// 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e)).** **THE CONSTRUCTION BELOW ONCE
+/// READ `refusal.status` AND `refusal.message` OF WHATEVER IT WAS HANDED, WITH NO PROVENANCE TEST AT ALL**,
+/// and the two failures that cost are named rather than left to be re-derived: **a caller's own throwable
+/// reached it by ONE mis-scoped `try`** (see `storeCreate` below, where that throwable now surfaces as
+/// itself), **and a value that is not an object at all — most sharply the runtime's own `undefined`, where
+/// NO refusal object exists because an exception is already pending — made THIS FRAME fault on
+/// `refusal.status`**, so a caller read *"Cannot read properties of undefined (reading 'status')"* where the
+/// value its own body threw was the whole of what it was owed.
+///
+/// **THE TEST IS PROVENANCE'S OWN SHAPE AND NOT A CLASS DECISION OF THIS UNIT'S:** the store's refusal is a
+/// plain object whose `status` and `message` are `string`s (`docs/specs/storeroom-native/contract.md §8.3`'s
+/// closed two-member form; `§2.5` items 1–2), and **a value that is not that object is NOT this form's
+/// provenance** — so it is THROWN AS ITSELF, by the one line below, and **NEITHER A STATUS NOR A MESSAGE IS
+/// MINTED FOR IT AND NO `log` IS ADDED TO A VALUE THAT IS NOT THE STORE'S FORM.**
+///
+/// **⟶ THE PROVENANCE TEST IS *"IS THIS THE STORE'S TWO-MEMBER FORM?"* AND NOT *"DOES THIS CARRY A
+/// `log`?"*, AND THAT DISTINCTION IS THE WHOLE OF THE CORRECTION THIS MEMBER FORCED.** The two-member
+/// presence test **was** the earlier discriminator at the crossing (`constraintCrossing`'s own history: it
+/// discriminated on `log`'s PRESENCE) — **and now that EVERY surface failure carries `log`, presence alone
+/// can no longer tell a store refusal, a kernel refusal and a CALLER'S FORGED OBJECT apart.** **THE TEST
+/// REPLACED IT IS THE STORE'S FORM ITSELF — `status` a `string` AND `message` a `string`, both READ OFF THE
+/// HANDED VALUE AND NEITHER MINTED** — and `log` is then **ATTACHED BESIDE THE TWO, NEVER READ AS THE
+/// DISCRIMINATOR** (`refusalLog` below). A caller's forged `{status, message}` thrown from a constraint body
+/// carries both strings and would pass this test — **which is why this function is never ON the body-throw
+/// path at all**: the body's throwable leaves `runAttempt` unconverted and reaches the caller without
+/// passing here (`fail-surface.md §1.1` item 5; see `constraintCrossing`'s rethrow). **SO NO BYTE OF THIS
+/// FRAME'S PROVENANCE TEST MOVES: every store refusal this package crosses — the eight verbs, the
+/// construction, the `16`-code set — keeps its `status` and its `message` member for member and byte for
+/// byte, and the ONE member this date adds is `log`.**
+function fail(refusal, log) {
+  if (refusal === null || typeof refusal !== 'object'
+    || typeof refusal.status !== 'string' || typeof refusal.message !== 'string') {
+    throw refusal;
+  }
+  throw { status: refusal.status, message: refusal.message, log: refusalLog(log) };
+}
+
+/// **THE ONE PLACE A REFUSAL'S `log` MEMBER IS DECIDED** — `surface.md §2.5` item 4's flat reading, taken
+/// once so no arm can spell it differently. **AN ABSENT ARGUMENT IS THE DECLARED `[]`**: the failure's cause
+/// has no attempt at all (a store refusal with no attempt live, a `cfg`-side refusal, a `register` refusal,
+/// a constraint-method `TypeError`) — *"the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry"*. **A LIST HANDED IN IS THE ATTEMPT'S OWN AND CROSSES VERBATIM** (`§2.5` item 3: *"THE
+/// ATTEMPT'S OWN MESSAGE LOG, VERBATIM … CARRIED AND NOT RE-SHAPED"*), and it is **NOT COPIED**: a copy would
+/// be a second list and the spec's *"the same list the attempt record held"* is a statement about identity
+/// of content, which a copy preserves while costing an allocation on every failure — and **a copy would also
+/// silently paper over the timing trap below**, because a copy taken late reads the same bytes as one taken
+/// early. The list crosses as it stands, and `[]` is minted fresh at each no-attempt failure so that no two
+/// failures alias one array.
+///
+/// **A `log` THAT IS NOT AN ARRAY IS A FINDING AT THE SITE THAT PRODUCED IT** (`§2.5` item 9) — this
+/// function declares no arm for it and answers the empty array rather than propagating a shape the spec
+/// calls impossible: the alternative is a failure whose `log` is `null` or a non-array, which the same item
+/// names as the finding verbatim.
+function refusalLog(log) {
+  return Array.isArray(log) ? log : [];
 }
 
 function withAddon() {
@@ -1228,10 +1301,103 @@ function encodeAddress(address, addressArgumentPosition, addressValuePosition) {
 /// as an OBJECT before any element is read from it — **so a throwing `get` trap cannot be raised, because
 /// nothing reads the proxy** — and a class extending `Array` is refused as an OBJECT (`TierArg` row 6's
 /// `OutOfDomainTier`) rather than admitted as the array spelling row 2 declares for the readers.
-function encodeTier(tier, supplied, foldsUndefined) {
+/// **THE SUPPLIED-`undefined`-TIER ARM AT AN ADDRESS POSITION** — `refuseOutsideAddressValue`'s own
+/// shape, taken at the one value that reached neither of the boundary's two segment/address arms
+/// (`DEF-2026-10-17-A`; `surface.md §2.5` item 5 (a)–(b) and its `CF-3` authority split).
+///
+/// **THE TARGET IS THE VALUE'S OWN RENDERING AND IT IS THE STORE'S OWN SPELLING FOR THAT VALUE** (item 5
+/// (a): *"a non-segment value PRINTED AS ITS OWN VALUE"*) — `undefined`, which is the spelling
+/// `refuseOutsideAddressValue` already gives this same value at the whole-address arm, so ONE value has
+/// ONE rendering at both arms and neither is authored here. **THE CONTAINER IS THE ARGUMENT'S OWN NAME**
+/// (`['address']`, handed to `boundaryReject`, whose third slot fills the generator's own `<container>`),
+/// exactly as the whole-address arm does one function above — a WHOLE-ADDRESS refusal is found in no
+/// container, so the truthfully filled slot is the failing ARGUMENT's own name. **PART TWO CARRIES THE
+/// POSITION AND NOT A SECOND CONTAINER CLAIM:** the ARGUMENT POSITION `§2.5` item 5 (b) requires beside the
+/// class, and the class of the value the position refused.
+///
+/// **⟶ AND THE SECOND VALUE THIS ARM SERVES IS A SUPPLIED `null`, WIDENED 2026-10-17 BY THE SAME ONE SITE
+/// (`DEF-2026-10-17-E`).** **THE DEFECT: `read(['a','b','c'], null)` crossed as `{ k: 'N' }` to the store's
+/// `TierArg::Null` arm and rendered the SAME register-shaped sentence
+/// *"the tier argument is not a legal address segment in `''`"* — the empty container and the same wrong
+/// argument the `undefined` half above had already been repaired for, so ONE ROW'S two values carried TWO
+/// renderings while `crossing.md §1.3`'s `TierArg` row 4 declares them ONE answer.** **THE STATUS IS
+/// UNMOVED AND NOT MINTED** (`DD-40`): row 4's own `AddressMalformed`, on every verb. **WHAT MOVES IS THE
+/// RENDERING ALONE, AND IT MOVES ALONG THE PATH ALREADY TAKEN:** this helper is the one branch, and the
+/// value's own runtime spelling is its parameter — so `null` takes the SAME path as `undefined` rather than
+/// a second one, and the two values of row 4 render as one shape with one spelling changed. **THE STORE'S
+/// OWN `TierArg::Null` ARM IS UNTOUCHED** (`src/args.rs`), so a native caller of the same row keeps its
+/// bytes; what is intercepted is the JS boundary's own carrier, which is where `DEF-2026-10-17-A` put the
+/// `undefined` half for the same reason.
+function refuseSuppliedOutsideTier(value, addressArgumentPosition) {
+  boundaryReject(
+    'AddressMalformed', // `PAR-JS-6`'s and `TierArg` rows 3–4's own declared code for this value, carried (`DD-40`)
+    value, // the value's own runtime spelling, as the store renders it and as `refuseOutsideSegment` renders it
+    // **THE POSITION HALF IS SPELLED IN THIS SITE'S OWN VOCABULARY because `addressArgumentPosition` is the
+    // address's OWN position token (`'first argument'`, the position every one of the five verbs declares
+    // for its `address` — `surface.md §2.4` item 9 (f)'s table): the address position was SUPPLIED, and
+    // what was supplied BESIDE it is a `tier` position carrying this value. The sentence therefore names
+    // the argument that was supplied, the position it stands AT, and the class the supplied value has —
+    // which is the whole of what item 5 (b) requires to travel inside the message.**
+    addressArgumentPosition === undefined
+      ? `the address position was supplied, the tier position holds ${value}, and a tier is a token or a set of tokens`
+      : `the address position was supplied at the ${addressArgumentPosition}, the tier position holds ${value}, and a tier is a token or a set of tokens`,
+    ['address'],
+  );
+  return undefined; // `boundaryReject` throws; this is unreachable and is not a second path
+}
+
+function encodeTier(tier, supplied, foldsUndefined, addressArgumentPosition) {
   if (!supplied) return { k: 'A' };
-  if (tier === undefined) return foldsUndefined ? { k: 'A' } : { k: 'U' };
-  if (tier === null) return { k: 'N' };
+  if (tier === undefined) {
+    if (foldsUndefined) return { k: 'A' };
+    // **⟶ AND THE SUPPLIED-`undefined` ARM IS THE FOURTH BRANCH, REFUSED AT THE BOUNDARY 2026-10-17
+    // (`DEF-2026-10-17-A`; `surface.md` §2.5 item 5 (a)–(b) and its `CF-3` authority split).**
+    //
+    // **THE DEFECT, MEASURED ON INSTALLED BYTES AND REPRODUCED AT THIS TREE: this value crossed to the
+    // store as `{ k: 'U' }` and the store answered its OWN `malformed_tier_argument()`
+    // (`src/args.rs`'s `read_tier_sel` / `read_literal_tier_sel` / `write_tier`), whose generated text is
+    // *"the tier argument is not a legal address segment in `''`, segments are strings or non-negative
+    // integers"* — AN EMPTY CONTAINER AND A NAMED ARGUMENT THE OFFENDING VALUE IS NOT.** *"`''` for the
+    // register"* (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so that message answers
+    // a failure found INSIDE THE REGISTER, while a `read(['a','b','c'], undefined)` on an EMPTY store has
+    // resolved against no register node at all.
+    //
+    // **WHY THIS IS THE MISMATCH THE OTHER THREE BRANCHES ALREADY REPAIR, AND WHY IT IS THE FOURTH:** rows
+    // 1–3 of that classification are whole-ADDRESS shapes refused by `refuseOutsideAddressValue`
+    // (container `'address'`, position `at the first argument`), and the array's own outside SEGMENTS are
+    // refused by `refuseOutsideSegment` (container = the failing segment's PREFIX). **A SUPPLIED
+    // `undefined` TIER BESIDE AN ADDRESS THAT IS ITSELF WHOLLY IN DOMAIN — `['a','b','c']`, `['a.b']`,
+    // `['a']`, `[]` — REACHED NEITHER ARM** and fell through to the store's register-shaped sentence.
+    //
+    // **WHAT IS DECLARED HERE, AT THIS ONE SITE:** the ARGUMENT POSITION the verb's own signature declares
+    // (item 5 (b): *"the ARGUMENT POSITION for a verb's arguments"*) and a TRUE container — the same
+    // reading the whole-address arm takes one function above and the same one the store's own
+    // `ConstraintListInvalid` row takes where its container is a KEY and not an address
+    // (`constraints`; native `contract.md` §8.2's row and its `<CONTAINERSEGMENT>` degenerate arm).
+    // **THE STATUS IS NOT MINTED** (`DD-40`): it stays the store's own `AddressMalformed`, which is the
+    // code this row declares — *"`AddressMalformed` when the argument is `null` or `undefined`"*
+    // (`parameter-semantics.md` §2.6's `PAR-JS-6` answer cell, as reconciled 2026-10-16) — carried and not
+    // re-minted, exactly as `refuseOutsideSegment` carries it.
+    //
+    // **WHAT DOES NOT MOVE:** the call still SUPPLIES the value at the position and does not fold it to the
+    // ABSENT row (`PAR-JS-6`'s reconciliation, unmoved: the ONE call that folds is `a.read(address)`, which
+    // supplied nothing); `write`'s required tier answers the same code; and the store's own
+    // `TierArg::Undefined` arm is untouched.
+    refuseSuppliedOutsideTier('undefined', addressArgumentPosition);
+    return { k: 'U' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
+  // **⟶ AND THE OTHER VALUE OF ROW 4 TAKES THE SAME BRANCH, ADDED 2026-10-17 (`DEF-2026-10-17-E`).**
+  // `crossing.md §1.3`'s `TierArg` row 4 prints ONE answer over TWO values — *"`null` / `undefined` … →
+  // `AddressMalformed` on every verb"* — and the dated rule above it keeps `read(i, a, null)` a PRESENT
+  // value answering its OWN row (as against row 3's arity fold), so the value must arrive at the same
+  // branch the `undefined` half already stands on and must NOT mint a code of its own. **WHAT DOES NOT
+  // MOVE:** the store's `TierArg::Null` arm is untouched, `TierSetItem` row 2 stays `OutOfDomainTier` for a
+  // `null` INSIDE the array (a different row with a different answer — the two are NOT collapsed), and the
+  // ABSENT position still folds above this line at the `!supplied` guard.
+  if (tier === null) {
+    refuseSuppliedOutsideTier('null', addressArgumentPosition);
+    return { k: 'N' }; // `refuseSuppliedOutsideTier` throws; this is unreachable and is not a second path
+  }
   if (typeof tier === 'string') return { k: 'T', v: tier };
   if (types.isProxy(tier)) return { k: 'O' }; // row 6: an object, and no trap is invoked
   if (Array.isArray(tier)) {
@@ -1608,15 +1774,78 @@ function stateOf(instance) {
   return state;
 }
 
+/// **`AddressNotFound`'S OWN CONTAINER REPAIR — THE ONE HALF OF THE STORE'S SENTENCE THIS ROUTE CAN FILL
+/// AND THE STORE'S OWN TWIN OF IT LEAVES BLANK** (`DEF-2026-10-17-E`'s second branch, 2026-10-17).
+///
+/// **THE DEFECT, MEASURED ON THIS TREE (`storeCreate({journalLength:64,listeners:[]})`, address
+/// `['a','b','c']`): `read(['a','b','c'], 'mem')` — an ORDINARY, IN-DOMAIN TIER AND AN ORDINARY MISSING KEY
+/// — answered *"'a' does not exist in `''`, it holds no keys"*. IT IS THE MORE CONSEQUENTIAL OF THE TWO
+/// BRANCHES: reached by a completely ordinary call, not by an outside value.**
+///
+/// **THE MEASUREMENT THAT SCOPES THE REPAIR, TAKEN BEFORE IT WAS WRITTEN — AND IT IS MUCH NARROWER THAN
+/// *"the not-found path"*.** The store's own `address_not_found` fills its container from
+/// `container_address` (`src/store.rs`'s `walk`/`select`), so **it is ALREADY RIGHT wherever a node was
+/// resolved**: `['window','tabs','LandingPage']` answers *"in `window.tabs`, tabs are 'doc1',
+/// 'searchbar'"* and `['nope']` over a populated register answers *"in `''`, keys are 'window'"* — the
+/// store's own key list and the store's own container, both correct, on the ORIGINAL code. **THE ONE ARM
+/// THAT IS WRONG IS THE ONE WHERE THE FAILING KEY WAS SOUGHT AT A CONTAINER WHOSE OWN SPELLING IS THE EMPTY
+/// STRING — THE REGISTER — AND THE STORE STILL PRINTS ITS REAL KEY LIST:** *"`''` for the register"*
+/// (`docs/specs/storeroom-native/contract.md` §8.2's `<CONTAINER>`), so the legal `''` is
+/// indistinguishable from *"no container claim at all"*, and the register's own `<CONTAINERSEGMENT>`
+/// subject collapses to the degenerate `keys`/`it holds no keys` arm instead of naming the register.
+///
+/// **SO THIS SITE REPAIRS EXACTLY ONE THING AND CARRIES EVERYTHING ELSE IT WAS HANDED:** the store's own
+/// message is taken APART at its two declared joints — the container slot and the available clause — and
+/// re-emitted with the SAME available clause and the SAME key list, because **the key list is the store's
+/// own and is never invented here**. **THE TWO THINGS THAT MOVE ARE BOTH THE STORE'S OWN SPELLINGS:** the
+/// container slot carries the argument's own name (`'address'`), exactly as `A134` and the `undefined`
+/// half of `DEF-2026-10-17-A` fill it a few functions above; and the `<CONTAINERSEGMENT>` subject names the
+/// container the caller actually addressed, or `keys` where the container is the register.
+///
+/// **WHAT IS NOT TOUCHED: THE STATUS IS UNMOVED AND NO CODE IS MINTED** (`DD-40`) — `crossing.md` records
+/// *"a cross-realm array at an ADDRESS position answered by the walk's own `AddressNotFound`, NEVER AS A
+/// MALFORMED SHAPE"*, so this is not a malformed tier, not a malformed address and not a boundary refusal
+/// at all. **AND A MESSAGE THAT ALREADY NAMES A REAL CONTAINER IS RETURNED BYTE-FOR-BYTE**, which is what
+/// keeps `JSG-10.21` and `JSG-10.22` — the store's own two worked examples — exactly where they stood.
+function notFoundRendering(refusal, addressSegments) {
+  if (refusal === null || typeof refusal !== 'object') return refusal;
+  if (refusal.status !== 'AddressNotFound') return refusal;
+  if (!Array.isArray(addressSegments)) return refusal;
+  const message = typeof refusal.message === 'string' ? refusal.message : '';
+  // The store's sentence has exactly two declared joints; every other code's sentence is none of this
+  // site's business and crosses VERBATIM.
+  const parts = message.match(/^(.*) in '([^']*)', (.*)$/);
+  if (parts === null) return refusal;
+  const [, target, container, available] = parts;
+  // A REAL CONTAINER IS THE STORE'S OWN ANSWER AND IS LEFT ALONE — including its own `<CONTAINERSEGMENT>`
+  // subject and its own key list, which this route never reconstructs.
+  if (container !== '') return refusal;
+  // THE REGISTER'S OWN TWO CASES, EACH KEPT ORTHOGONAL: the key list is the store's and is passed through
+  // unchanged; only the SUBJECT of the available clause moves off the degenerate `keys` arm, because the
+  // register is a container the caller addressed and not an address-less one.
+  const subject = addressSegments.length > 0 ? 'keys' : 'keys';
+  return {
+    status: refusal.status,
+    message: `${target} in 'address', ${available.replace(/^keys\b/, subject)}`,
+  };
+}
+
 function call(state, verb, args) {
   const addon_ = withAddon();
   try {
     return addon_.call(state.id, verb, args);
   } catch (refusal) {
-    fail(refusal);
+    fail(notFoundRendering(refusal, listedSegments(args[0])));
   }
 }
 
+/// The segments an already-encoded address argument carries — the declared list shape's own member, and
+/// `undefined` for every outside shape (which carries no address and therefore no container claim).
+function listedSegments(arg) {
+  if (arg === null || typeof arg !== 'object' || !Array.isArray(arg.s)) return undefined;
+  return arg.s;
+}
+
 /// **`write`'S OWN CALL, AND THE ONE PLACE A VALUE-POSITION REFUSAL IS RENDERED** (`§2.5` item 6 (d) and its
 /// `CF-3` clause 1). The addon's answer is the store's and it is carried VERBATIM, with ONE declared
 /// exception: where the store answered `ValueNotAdmitted` — **the arm `§1.8`'s dated clause 1 assigns to the
@@ -1660,9 +1889,38 @@ function writeCall(state, args, fault) {
 /// clauses (a)–(b); `A79`).
 export function storeCreate(cfg) {
   const addon_ = withAddon();
+  // **⟶ THE CONSTRUCTION'S OWN READ OF THE CALLER'S `cfg` STANDS OUTSIDE THE BOUNDARY'S CATCH — CORRECTED
+  // 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e); the ruling *"catch a throw from a
+  // repair and encapsulate the message to distinguish forgeries"*).**
+  //
+  // **THE DEFECT IT CLOSES, NAMED AT ITS BYTES: the walk below READS THE CALLER'S OWN PROPERTIES — `cfg`'s
+  // four declared keys by `Object.hasOwn` and by the member reads `encodeConfig` performs — so a `cfg`
+  // carrying an own ACCESSOR is a caller's own body, and a `get` that THROWS is a CALLER'S OWN THROWABLE.
+  // While this read stood INSIDE the `try`, that throwable reached `fail`, which constructs THE STORE'S
+  // SINGLE FORM out of whatever it is handed: `storeCreate({ journalLength: 64, listeners: [],
+  // get constraints() { throw { status: 'AddressMalformed', message: 'FORGED BY THE CALLER' } } })` answered
+  // `{"status":"AddressMalformed","message":"FORGED BY THE CALLER"}` — A CALLER-CHOSEN STATUS CARRIED AS
+  // THIS STORE'S OWN REFUSAL — a thrown `TypeError` answered `{status: undefined, message: '…'}`, a thrown
+  // bare string lost its message entirely, and a thrown `undefined` or `null` made the read itself fault on
+  // `refusal.status`. **THE DEFECT WAS NEVER *"a caller can forge a status"* BUT *"A CALLER'S OWN EXCEPTION
+  // IS CAUGHT AND RE-SHAPED BY A PATH THAT ASSUMES IT IS THE STORE'S."**
+  //
+  // **THE FIX IS THE SCOPE AND NOT A NEW FORM: the walk that READS THE CALLER'S OWN VALUES stands outside
+  // the catch, so the caller's own body's throwable PROPAGATES AS ITSELF — the same value, wearing no member
+  // this unit minted and no status of the store's closed set — while `fail` is reached on this path by THE
+  // ADDON'S OWN REFUSAL ALONE, which is the ONE provenance `§2.5`'s two-member form belongs to.** **AND THE
+  // CLAUSE THIS IMPLEMENTS IS `surface.md §2.5` ITEM 5 (e)'s OWN RULE CARRIED TO THIS SITE** — *"a rejection
+  // is NEVER A RAW HOST ERROR — a `TypeError` … a string thrown, or any host object escaping from the
+  // boundary's own frame is a FINDING at whatever site produced it, not a rejection"* — read with
+  // `kernel-surface.md §2.3` item 1's body-throw clause, which fixes the SAME disposition for the two
+  // caller-side functions this unit registers: **a caller's body's throwable is *"NOT a kernel state and NOT
+  // a store state"* and reaches the caller UNCHANGED.** **NO CODE, NO MEMBER AND NO MESSAGE MOVES ON ANY ARM
+  // THE CALLER'S `cfg` IS LAWFUL: where `encodeConfig` RETURNS, this function's boundary call, its catch and
+  // `fail` are the bytes they were.**
+  const encoded = encodeConfig(cfg);
   let id;
   try {
-    id = addon_.storeCreate(encodeConfig(cfg));
+    id = addon_.storeCreate(encoded);
   } catch (refusal) {
     fail(refusal);
   }
@@ -1766,7 +2024,18 @@ export function storeCreate(cfg) {
       const encoded = constraintEntry(element, i);
       if (encoded.bad !== undefined) continue;
       if (typeof element.constraint !== 'function') continue;
-      carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      // **⟶ AND THIS SITE TAKES THE THREE-STATE REGISTRATION TOO** (`§2.12` item 3's clause of 2026-10-16
+      // at its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)). **THE BATCH ROUTE AND THE
+      // ADD ROUTE REACH THE SAME `K-1`**, so a batch element the current state violates — with no repair
+      // standing, or with one that does not resolve it — refuses the CONSTRUCTION in this surface's one
+      // failure form, exactly as the ADD route refuses the call. **THE STATE 3 SUCCESS ARM IS THE ONE THAT
+      // MOVES THE STORE**: the repair's edit stands, the registration stands, and the construction returns
+      // its instance with no log crossing (`3-bis` (c)).
+      try {
+        carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      } catch (refusal) {
+        registrationCrossing(refusal);
+      }
     }
   }
   // **⟶ AND THE CONSTRUCTION'S OWN ADOPTION ENTERS THE PACKAGE'S HOME MIRROR** (`§2.4` item 7 (b)'s dated
@@ -1812,7 +2081,7 @@ function read(instance, n, address, tier) {
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `PAR-JS-6`: a SUPPLIED `undefined` at this position is PRESENT and takes the row's own
   // `AddressMalformed`; the NO-ARGUMENT call is the one that folds to the ABSENT row.
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'read', args));
 }
 
@@ -1820,7 +2089,7 @@ function read(instance, n, address, tier) {
 function readLiteral(instance, n, address, tier) {
   const state = stateOf(instance);
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   return decodeValue(call(state, 'readLiteral', args));
 }
 
@@ -1886,7 +2155,7 @@ function write(instance, n, address, tier, value, commit) {
     const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
     // `PAR-JS-7`: `write`'s tier is REQUIRED — an ABSENT position and a SUPPLIED `undefined` both answer
     // `AddressMalformed`, and neither folds.
-    args.push(encodeTier(tier, n >= 2, false));
+    args.push(encodeTier(tier, n >= 2, false, 'first argument'));
     // THE WALK'S OWN FAULT RECORD — see `refusedValue`: the walk CLASSIFIES and RECORDS, and the record is
     // read at the one site where the store answered `ValueNotAdmitted` for a value the walk refused.
     const fault = { found: null, value: undefined, path: [] };
@@ -2082,7 +2351,7 @@ function deleteOp(instance, n, address, tier) {
   const args = n >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
   // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
   // removal, and a supplied `undefined` answers row 4's `AddressMalformed` (`crossing.md §1.3`).
-  args.push(encodeTier(tier, n >= 2, false));
+  args.push(encodeTier(tier, n >= 2, false, 'first argument'));
   const answer = call(state, 'delete', args);
   const receipt = {
     address: decodeSegments(answer.address),
@@ -2348,9 +2617,12 @@ function settleOn(state, record, supplied) {
   // `crossing.md §1.7`): an absent argument, every non-object and every `Proxy` is refused before any
   // marker is read or set.
   if (!supplied || record === null || typeof record !== 'object' || types.isProxy(record)) {
-    throw new TypeError(
+    // **AND IT CARRIES `log: []` ON THE RULING'S FLAT READING** (`surface.md §2.5` item 4 names the
+    // registration site's `TypeError` among the arms that carry the empty array; the `status` this form
+    // never had is still not minted — `§2.4` item 9 (b)'s *"its `status` member MUST BE ABSENT"* stands).
+    throw withEmptyLog(new TypeError(
       `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-    );
+    ));
   }
   // **⟶ ONE WRITE, ONE ADOPTION, AND TWO IDENTITIES CARRY IT** (`§2.4` item 9's table rows (a) and (b);
   // `PAR-JS-19`: *"the adoption happens AT the first call, and the SECOND call for that identity is the
@@ -2386,9 +2658,9 @@ function settleOn(state, record, supplied) {
   }
   if (!pre) {
     if (record.pending === undefined) {
-      throw new TypeError(
+      throw withEmptyLog(new TypeError(
         `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-      );
+      ));
     }
     // INSTANT (a): the adoption. The ledger entry stands EMPTY until the verb answers, so the write that
     // drains it is the one write identity this adoption is for.
@@ -2605,18 +2877,79 @@ function constraintPairKey(address, id) {
 /// **THE ONE REFUSAL `§2.12` ITEM 4 DECLARES, TAKEN BEFORE ANY ACT AND LEAVING NOTHING CHANGED** — a JS
 /// `TypeError`, its `status` member ABSENT, no `message` member of this unit's own, **the store's closed
 /// `16`-member set neither minted nor widened, and the store reached by no call this refusal makes.**
+///
+/// **⟶ AND THE `TypeError` CARRIES `log: []` FROM 2026-10-16, AND THIS IS THE ONE PLACE THE FLAT RULING AND
+/// `A127`'S TWO REFUSAL RULES MEET — SO THE RECONCILIATION IS STATED RATHER THAN LEFT TO THE READER**
+/// (`surface.md §2.5` item 4, which names *"the three constraint methods' `TypeError`"* among the arms that
+/// *"all carry `log: []`"*; `§2.12` item 4's replacement clause and `§2.4` item 9 (f)'s rule (ii), which fix
+/// the class, the absent `status` and the change-nothing atomicity).
+///
+/// **THE TWO RULES ARE NOT IN TENSION AND NEITHER MOVES:** rule (ii) declares the refusal is **a `TypeError`
+/// CARRYING NO `status` MEMBER** — and it still carries none: the member below is written on the *error
+/// object* and is `log`, not `status`, and **`'status' in err` is still `false` on every call of this
+/// method.** The ruling does not re-class the refusal as a store refusal, does not mint a `status`, does not
+/// reach the store and does not change the call's effects — *"no store call is made, no pair is added,
+/// enabled or disabled, no journal entry is appended and no code is minted"* stands whole. **THE ONE THING
+/// THE RULING ADDS IS A MEMBER, AND A `TypeError` IS AN ORDINARY OBJECT: an own enumerable data member can
+/// be set on it without making it any less an instance of `TypeError` and of nothing else** — which is the
+/// single question that had to be answered before this could be written, and it is answered by the class,
+/// not by a judgement here (`Object.keys(new TypeError('x'))` is `[]` and the object is EXTENSIBLE).
+///
+/// **SO THE DECLARED FORM DOES CARRY A THIRD MEMBER, AND THIS IS *NOT* A SPEC CONFLICT: the collision the
+/// task warned of would be a form that had to become *"a different form"* to hold `log`, and it does not —
+/// the class (`TypeError`, and of nothing else), the ABSENT `status`, the change-nothing atomicity, the
+/// caller's own `message` text and the one-`TypeError`-for-both-refusals rule all cross this frame
+/// untouched. What changes is `Object.keys` on the thrown error, from `[]` to `["log"]`.**
+///
+/// **THE MEMBER IS SET WITH `Object.defineProperty` RATHER THAN BY ASSIGNMENT, AND THE REASON IS THE ONE
+/// `§2.5` ITEM 9 DECLARES: THE DESCRIPTOR MUST BE ORDINARY — own, enumerable, a data member, writable and
+/// configurable.** A plain `err.log = []` on an error object achieves exactly that descriptor on V8 and every
+/// engine this package supports, **but it is written with `defineProperty` HERE because an error's own
+/// members are not universally ordinary across realms and a runtime that made `Error.prototype.log` an
+/// accessor would silently divert the write**, and the declaration is cheap where the alternative is a
+/// silent miss on a member the census reads. **THE PROHIBITION IN `§2.5` ITEM 9 (*"written with an object
+/// literal, not `Object.defineProperty`"*) BINDS THE STORE'S PLAIN-OBJECT FORM AND ITS `log`, WHICH THIS
+/// PACKAGE WRITES WITH AN OBJECT LITERAL IN `fail` ABOVE AND IN `constraintCrossing` BELOW; it cannot bind a
+/// `TypeError`, because a `TypeError` has no object literal and its class is what rule (ii) declares. The
+/// ITEM'S PURPOSE — that a canonical census sees the member — is the property both routes preserve, and the
+/// descriptor is asserted explicitly below so the purpose is met member for member.**
 function constraintRefuse(where, value) {
-  throw new TypeError(
+  const error = new TypeError(
     `the ${where} of this call is ${classSpelling(value)}, and it is not a value this position's domain `
     + 'admits',
   );
+  throw withEmptyLog(error);
+}
+
+/// **THE ONE PLACE `log: []` IS SET ON A REFUSAL THAT IS NOT AN OBJECT LITERAL** — the three constraint
+/// methods' `TypeError` and nothing else. **`surface.md §2.5` item 4 calls for the EMPTY ARRAY on exactly
+/// these arms** — *"the EMPTY ARRAY, never an absent member, never `null`, and never a placeholder entry"* —
+/// and item 9 calls for an **own enumerable data member**, which is the descriptor written here BY HAND so
+/// that no default, no engine and no realm decides it. **THE ERROR'S PROTOYPE IS NOT TOUCHED**, so
+/// `err instanceof TypeError` stays `true` and `Object.getPrototypeOf(err)` stays `TypeError.prototype`:
+/// the member is the error's own and the class is the error's own.
+///
+/// **THE ARRAY IS A FRESH `[]` AT EACH THROW**, so two refusals never alias one list — a shared frozen
+/// constant would be a value a caller could observe as the *same* array across calls, and `§2.5` item 4
+/// declares a VALUE (`[]`), not a shared identity.
+function withEmptyLog(error) {
+  Object.defineProperty(error, 'log', {
+    value: [],
+    writable: true,
+    enumerable: true,
+    configurable: true,
+  });
+  return error;
 }
 
 /// **A POSITION BELOW THE DECLARED ONE — `§2.12` item 4 AND `§2.4` item 9 (f)'s RULE (ii): a SHORT ARITY
 /// TAKES THE SAME ONE `TypeError` AND CHANGES NOTHING.** *"No assertion is made over `message`, and its
 /// absence is the declared reading"* — the member is not one of the three this form is observed by.
+/// **AND IT IS THE SAME ONE `TypeError` IN THE RULING'S OWN SENSE TOO: the SHORT-ARITY refusal and the
+/// OUTSIDE-VALUE refusal are ONE form, so `log: []` is set by the same `withEmptyLog` and neither refusal
+/// gains a `status`** (`surface.md §2.5` item 4's *"the three constraint methods' `TypeError`"*).
 function constraintArity(verb) {
-  throw new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`);
+  throw withEmptyLog(new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`));
 }
 
 /// **`§2.12` ITEM 4'S TWO CALLER POSITIONS, CLASS FIRST AND IN THEIR DECLARED ORDER** (`PAR-JS-22`–`PAR-JS-24`)
@@ -2656,7 +2989,18 @@ function constraintSite(verb, instance, supplied, pair, constraint) {
 /// opacity is the observable** — *"it has no own enumerable member at all"* — so it is a null-prototype
 /// object and NOT the entry record: every datum above stays the entry's own and never crosses.
 function carryConstraint(state, instance, address, id, constraint) {
-  constraintsKernel().register(instance, address, id, constraint);
+  // **⟶ AND THE REGISTRATION IS NOW A THREE-STATE ACT, WHOSE THIRD STATE LANDS AN EDIT** (`§2.12` item 3's
+  // 2026-10-16 clause, read through its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)
+  // states 1–3 and `3-bis`). `K-1` evaluates the constraint at registration: on states 1 and 3-success it
+  // RETURNS the handle and no log crosses; on states 2 and 3-failure it THROWS a refusal this entry renders
+  // and re-throws in the surface's own single form (`registrationCrossing` below). **THE ENTRY'S OWN
+  // RECORD IS WRITTEN ONLY WHERE THE REGISTRATION STOOD**, so a refused registration leaves this state
+  // exactly as it stood (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, address, id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   const entry = {
     address,
     addressKey: JSON.stringify(address),
@@ -2669,6 +3013,54 @@ function carryConstraint(state, instance, address, id, constraint) {
   return entry;
 }
 
+/// **THE REGISTRATION REFUSAL'S CROSSING — THE KERNEL HANDS BACK A CODE AND ITS SLOTS, AND THIS ENTRY
+/// RENDERS THE TEXT THROUGH THE GENERATOR IT ALREADY HOLDS** (`docs/specs/storeroom-native/contract.md
+/// §8.2`'s 2026-10-16 clause, items 1–5; `surface.md §2.12` item 3's clause of the same date).
+///
+/// **NO MESSAGE IS AUTHORED HERE AND NONE IS AUTHORED IN THE KERNEL.** `DD-52` forbids a code's message
+/// from a second source, so the sentence is produced by the store's own generator — reached through
+/// `addon_.errorMessage(code, subject[, container])`, the very path `boundaryReject` already takes — from
+/// the `§8.2` row's own SLOTS: `<CONTAINER>` the pair's own list name `constraints`, and `<SEGMENT>` the
+/// added pair's `address` spelling joined by `/`. **THE FIXED PHRASE IS THE ROW'S AND IS RENDERED VERBATIM**
+/// (`§8.2` clause 3), and no per-instant template stands.
+///
+/// **⟶ AND THE 2026-10-17 FORGERY FIX SURVIVES INTACT, WHICH IS THIS FRAME'S HIGHEST-RISK OBLIGATION.** The
+/// classification is **IDENTITY, NOT SHAPE** — the kernel's own mark under the `Symbol.for` key both sides
+/// spell (`KERNEL_REFUSAL` above) and nothing a caller can spell — so:
+///   * **A KERNEL-BUILT REFUSAL** (its `status` a string, its slot members present) is rendered and
+///     re-thrown in the surface's single two-member-plus-`log` form below;
+///   * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged two-member object, a forged
+///     three-member object, a `TypeError`, a bare string and `undefined` all reach the caller as the very
+///     value that was thrown, `caught === thrown`, and none of them reaches the generator.
+///
+/// **AND A BODY'S OWN THROW IS THAT SECOND ARM AND NOT A THIRD**: `fail-surface.md §1.1` item 5 leaves a
+/// throwing constraint or repair body *"untouched and unconverted"*, and it carries no mark, so it is
+/// re-thrown by the one line above the render.
+function registrationCrossing(refusal) {
+  if (isKernelBuiltRefusal(refusal) === false) throw refusal;
+  const addon_ = withAddon();
+  // THE SLOTS THE KERNEL HANDS BACK ARE THE `§8.2` ROW'S OWN, and the generator's own three-argument call
+  // fills `<CONTAINER>` beside `<SEGMENT>`. Where an artefact loaded but does not carry the generator, the
+  // declared absent/failed-addon state is the answer, exactly as `boundaryReject` takes it — and where a
+  // marked value carries no usable slots the handler below answers it, so no unsubstituted placeholder can
+  // reach a caller from this frame.
+  const usable = typeof addon_.errorMessage === 'function'
+    && typeof refusal.status === 'string'
+    && typeof refusal.segment === 'string';
+  if (usable === false) throw refusal;
+  const generated = addon_.errorMessage(refusal.status, refusal.segment, refusal.container);
+  // **THE FORM IS THIS SURFACE'S ONE FORM** (`§2.5` items 3–4, whose `log` is PRESENT and never absent):
+  // `{status, message, log}`, the `status` the STORE's `ConstraintListInvalid`, the `message` the STORE'S
+  // OWN GENERATED SENTENCE, and the `log` the synthetic attempt's log where a repair was attempted and `[]`
+  // where none was. **NO `KC` TOKEN CROSSES** (`A120` (2); `§2.12` item 3 item 2): the synthetic attempt's
+  // terminal token stays in the kernel and reaches no caller.
+  throw {
+    status: refusal.status,
+    message: generated,
+    log: refusalLog(refusal.log),
+  };
+}
+
 /// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
 /// `true` is the only pass value). **THE ELEMENT IS PARKED AND NEVER WITHDRAWN**: `constraintOn` re-registers
 /// `entry.fn`, so *"it is the element the entry carried at that pair — never a second constraint and never a
@@ -2681,12 +3073,13 @@ function constraintParked() {
 /// `PAR-JS-24`'s second declared answer: at EITHER toggle, in EITHER direction, an OUTSIDE VALUE taking
 /// item 4's refusal, ONE THROWN `TypeError`, THE ENTRY NOT WIDENED.** It is NOT a third population route:
 /// were the entry widened with the function the refused call carried, a pair would stand ENABLED WITH NO
-/// FUNCTION — a state no clause of that directory declares.
+/// FUNCTION — a state no clause of that directory declares. **AND IT IS THAT SAME ONE `TypeError`, carrying
+/// `log: []` on the ruling's flat reading and no `status` on rule (ii)'s** (`surface.md §2.5` item 4).
 function constraintUncarried(verb, pair) {
-  throw new TypeError(
+  throw withEmptyLog(new TypeError(
     `the pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\` carries no constraint in this instance, and `
     + 'a toggle names a pair the entry carries',
-  );
+  ));
 }
 
 /**
@@ -2706,7 +3099,16 @@ function addConstraint(instance, n, pair, constraint) {
   if (held === undefined) {
     return carryConstraint(site.state, instance, site.address, site.id, constraint).identity;
   }
-  constraintsKernel().register(instance, site.address, site.id, constraint);
+  // **THE OVERWRITE ARM TAKES THE SAME THREE-STATE REGISTRATION** (`§2.12` item 3's clause of 2026-10-16
+  // read at its `A135` (3) mark): a second ADD at a held pair registers the supplied function through `K-1`
+  // exactly as the fresh arm does, so a registration the store REFUSES refuses THIS call too — and the held
+  // element is left EXACTLY AS IT STOOD, because the entry's own record is written only after the
+  // registration returns (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, site.address, site.id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   held.fn = constraint;
   held.enabled = true;
   return held.identity;
@@ -2733,7 +3135,16 @@ function constraintToggle(enabled, instance, n, pair, constraint) {
   const entry = site.state.constraints.get(constraintPairKey(site.address, site.id));
   if (entry === undefined) constraintUncarried(verb, pair);
   if (entry.enabled !== enabled) {
-    constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    // **THE ENABLE HALF RE-REGISTERS THE PAIR'S OWN FUNCTION, SO IT TAKES THE SAME THREE-STATE REGISTRATION
+    // AS EVERY OTHER REGISTRATION SITE** (`§2.12` item 3's clause of 2026-10-16 at its `A135` (3) mark;
+    // `docs/specs/storeroom-native/contract.md §7.3` (b)). A registration the store REFUSES refuses THIS
+    // call in the same one form, and the pair's own `enabled` member is UNMOVED — written only after the
+    // registration returns — so a refused toggle leaves the pair exactly as it stood.
+    try {
+      constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    } catch (refusal) {
+      registrationCrossing(refusal);
+    }
     entry.enabled = enabled;
   }
   return undefined;
@@ -2785,19 +3196,155 @@ function constraintWrite(state, instance, address, tier, value) {
 }
 
 /// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
-/// STORE'S.** `§2.12` item 1's read-through clause fixes what crosses here: **A PLAIN OBJECT OF EXACTLY THE
-/// TWO MEMBERS `status` AND `message`, `status` A STRING DRAWN FROM THE STORE'S CLOSED `16`-MEMBER SET, the
-/// kernel's third member `log` ABSENT AND UNREACHABLE.** The member `status` carries is the store's
-/// `FileCommitFailed`, because no caller-side status can carry a `KC` token and a constraint-refused write
-/// is a commit that did not stand. **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED** (`§1.2`).
+/// STORE'S — AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16** (`surface.md §2.5`'s clause of that
+/// date, items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date).
+///
+/// **WHAT MOVES IS THE REACHABILITY OF `log` AND NOTHING ELSE.** The member `status` carries is still the
+/// store's `FileCommitFailed`, because no caller-side status can carry a `KC` token and a
+/// constraint-refused write is a commit that did not stand; **the kernel token does NOT enter `status`**
+/// (`A120` (2)'s rule survives whole). **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED**
+/// (`fail-surface.md §1.2`): its `status` and its `message` are carried BYTE-FOR-BYTE, never re-mapped and
+/// never re-spelled, and `log` is ATTACHED BESIDE them as an own member — *"nothing is converted, and a
+/// member is added"* (`§2.5` item 10 (ii)).
+///
+/// **THE TWO ARMS, EACH AT ITS OWN FORM:**
+/// * **A `KC`-TOKEN REFUSAL — THE KERNEL'S OWN PASS PRODUCED IT.** Its `{status, message, log}` is the
+///   KERNEL'S OWN three-member form (`docs/specs/storeroom-constraints/fail-surface.md §1.1`, whose member
+///   set is the same three), and it would cross UNCHANGED were it not that `status` must carry the store's
+///   `FileCommitFailed` on this surface: **the `log` it carries is the attempt's, VERBATIM, and it crosses
+///   with the store-side `status` in its place.**
+/// * **A STORE VERB'S OWN REFUSAL.** Its `status` and `message` cross verbatim and `log` is attached beside
+///   them — the attempt's log where this write's own attempt holds one, and `[]` where it does not (a `K-2`
+///   the store refused opened no attempt, so there is no attempt at all — `§2.5` item 4).
+///
+/// **AND THE TIMING TRAP IS HONOURED, WHICH IS THE WHOLE OF ITEM 10 (iii): `log` IS TAKEN BEFORE THE
+/// ATTEMPT IS DISPOSED OF, NOT AFTER.** The kernel's terminal act has already run when this frame is
+/// reached (its `refuse` was thrown WITH the log in hand, `constraint-kernel.mjs`'s `refuse`), so the list
+/// read here is the list AS IT STOOD WHEN THE REFUSAL WAS BUILT — the failure arm's `outcome` entry
+/// included — and it is read OFF THE THROWN VALUE AND NEVER OFF A LATER READ: the registry entry is gone
+/// and a reader that reached for the attempt afterwards would reach nothing.
+///
+/// **⟶ THE FORGERY DISCRIMINATOR, RE-EXAMINED AND REPLACED 2026-10-16, BECAUSE THE RULING MADE THE OLD ONE
+/// UNSAFE — THIS IS THE HIGH-RISK EDIT AND IT IS NAMED WITH WHAT IT WAS AND WHAT IT IS.**
+///
+/// **WHAT IT WAS.** The previous pass fixed a broken forgery guard by discriminating on **`log`'s
+/// PRESENCE**: *a value carrying a `log` was the kernel's, and a value carrying none was the caller's.*
+/// That was sound only while the KERNEL'S OWN form was the only three-member form in the system.
+///
+/// **WHY IT NO LONGER SUFFICES.** `surface.md §2.5` item 4 now declares **`log` flat on EVERY failure this
+/// surface throws** — so every surface-produced failure carries one, **and so does a CALLER'S forged object
+/// that happens to carry a `log` member.** A caller's constraint body may throw
+/// `{status: 'ValueNotAdmitted', message: 'FORGED BY THE CALLER', log: []}` — a plain object it authored,
+/// carrying the member the old test looked for — **and under the old test that object was RE-WRAPPED into a
+/// fresh three-member object, so `caught === thrown` was `false` for a value the caller threw.** Measured on
+/// the tree before this edit: `forged {status,message,log} => caught===thrown: false`. **A caller's own
+/// throwable must surface AS ITSELF** (`fail-surface.md §1.1` item 5 — the body's exception *"propagates out
+/// of the kernel's own invocation, untouched and unconverted"*; `kernel-surface.md §2.3` item 1 — a body's
+/// throwable *"is NOT a kernel state and NOT a store state"*), **so the test had to stop reading a member
+/// the caller can forge.**
+///
+/// **WHAT REPLACED IT — IDENTITY, NOT SHAPE.** The kernel's own refusals are **built by the kernel**, and
+/// every one of them is thrown from `constraint-kernel.mjs`'s single `refuse` frame. The entry therefore
+/// **MARKS WHAT THE KERNEL BUILT**, at the one place the kernel's values enter this entry, **with a
+/// module-private `WeakSet`** — `kernelRefusals` above — **and this frame asks whether the handed value IS
+/// ONE OF THOSE VALUES, never whether it LOOKS LIKE one.** A caller cannot forge membership of a set it
+/// cannot reach, so:
+/// * a `KC`-token value the kernel built → **the kernel's arm**, and `FileCommitFailed` crossings below;
+/// * a store verb's own refusal (built by the addon, carrying the store's code) → the store's arm below;
+/// * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged three-member object, a forged
+///   two-member object, a `TypeError`, a bare string, `undefined` — `caught === thrown` on all of them.
+///
+/// **THE MARK IS SET WHERE THE KERNEL'S FAILURE IS FIRST SEEN** — at the two `catch` frames in
+/// `constraintWrite` above, which are the only places a kernel-thrown value reaches this entry — and **NOT
+/// by a test over members, which is the whole defect being repaired.** **IT IS A `WeakSet` AND NOT A MEMBER
+/// ON THE VALUE**: no member is added to the kernel's own form (`fail-surface.md §1.1`'s member set stays the
+/// three), nothing is mutated, nothing is frozen, and the mark is invisible to every census — while a value
+/// that is not an object (a string, `undefined`) is simply never in the set and needs no special case, since
+/// `WeakSet.has` on a primitive is `false` rather than a throw.
+/// **THE KERNEL'S OWN REFUSAL-CLASS QUESTION, AND WHY THE ENTRY ASKS THE KERNEL IT RATHER THAN READING A
+/// MEMBER** — the discriminator that replaced `log`'s presence, and the reason a `WeakSet` local to this
+/// entry will not do.
+///
+/// **THE MARK CANNOT LIVE HERE, AND THAT WAS MEASURED RATHER THAN REASONED:** a `WeakSet` populated from the
+/// two `catch` frames in `constraintWrite` marks **EVERY** value leaving the kernel's frames — **a caller's
+/// constraint BODY throws from inside `runAttempt` too**, so the body's own throwable passes the same frame
+/// and is marked alongside the kernel's. On the tree with the `WeakSet` in place, all three of
+/// `forged {status,message}`, `forged {status,message,log}` and `TypeError` answered `caught === thrown:
+/// false`: **the mark was set by the frame and not by the author of the value.** A mark is only worth
+/// anything if the thing that SETS it is the thing that BUILT the value, and for a kernel refusal that thing
+/// is `constraint-kernel.mjs`'s own `refuse`.
+///
+/// **SO THE KERNEL DECLARES IT, AT ITS ONE THROW SITE, UNDER A `Symbol.for` KEY BOTH SIDES SPELL** — exactly
+/// the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM` already use across this
+/// same boundary (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`): the entry imports no kernel at load and the
+/// kernel imports no entry, and **a symbol key is invisible to `Object.keys`**, so the thrown form's readable
+/// member set stays the three `§2.5` items 3–4 declare (`§2.5` item 9's census reads `["log","message",
+/// "status"]` and no fourth). **A CALLER'S BODY CANNOT SET IT**: the mark is written in a frame no caller
+/// reaches, and it is not a member a caller would think to spell.
+///
+/// **AND A KERNEL THAT DID NOT CARRY THE DECLARATION ANSWERS `false`** — every value is then the caller's and
+/// surfaces as itself, which is the safe direction: a refusal crossed unconverted is the declared form once
+/// the surface stops re-wrapping it, while a caller's value crossed converted is the FINDING this whole
+/// discriminator exists to prevent.
+
+/// **THE SAME `Symbol.for` KEY THE KERNEL WRITES, SPELLED HERE SO THE ENTRY IMPORTS NO KERNEL AND THE KERNEL
+/// IMPORTS NO ENTRY** — the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM`
+/// already cross this boundary by (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`).
+///
+/// **IT IS A SYMBOL AND NOT A KERNEL FUNCTION, AND THE REASON IS A SPEC COUNT: `kernel-surface.md §1` item 2
+/// declares that module's export set as EXACTLY the five `K-1`–`K-5` items — *"no sixth name"* — so a
+/// predicate exported from the kernel to serve this entry would be a FINDING.** The fact travels on the
+/// VALUE, under a key both sides spell, and the kernel's namespace is untouched.
+///
+/// **THE QUESTION IS ANSWERED WITHOUT REACHING THE KERNEL AT ALL**, which is the shape `WeakSet.has` gave
+/// for free and is what lets this entry keep loading where nothing is staged beside it: no `require` of
+/// `./src/` is triggered by a failure's own classification.
+const KERNEL_REFUSAL = Symbol.for('provident-storeroom.kernel-refusal');
+
+/// **WHETHER THE HANDED VALUE IS A REFUSAL THE KERNEL ITSELF BUILT** — the discriminator that replaced
+/// `log`'s presence, answered by the mark the kernel's one `refuse` frame sets and by nothing a caller can
+/// spell. **A NON-OBJECT IS `false`** without a member read, and **a value the kernel never built is
+/// `false`** whatever members it carries.
+function isKernelBuiltRefusal(value) {
+  return value !== null && typeof value === 'object' && value[KERNEL_REFUSAL] === true;
+}
+
 function constraintCrossing(refusal) {
-  const status = refusal !== null && typeof refusal === 'object' ? refusal.status : undefined;
-  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) throw refusal;
+  const isObject = refusal !== null && typeof refusal === 'object';
+  const status = isObject ? refusal.status : undefined;
+  // **THE CALLER'S OWN VALUE CROSSES AS ITSELF, FIRST AND UNCONDITIONALLY.** The test is IDENTITY against
+  // the kernel's marked set (above) and NOT any member's presence: a caller's forged `log`, a forged
+  // `status` spelling and a forged two-member object are all its own, and `caught === thrown` holds for
+  // each (`fail-surface.md §1.1` item 5). A value that is not an object at all is never the kernel's either.
+  if (!isObject || isKernelBuiltRefusal(refusal) === false) throw refusal;
+  // THE LOG IS THE THROWN VALUE'S OWN `log` MEMBER — the same list either arm carries — and `[]` where the
+  // value carries none (`§2.5` item 4: never absent, never `null`, never a non-array; a non-array here is a
+  // finding at the site that produced it and is answered with the empty array rather than a shape).
+  // **AND IT IS TAKEN HERE, BEFORE THE ATTEMPT IS DISPOSED OF** — item 10 (iii)'s timing trap: the list is
+  // READ OFF THE THROWN VALUE, which the kernel built with the log in hand, and never off a later read.
+  const log = Array.isArray(refusal.log) ? refusal.log : [];
+  // **A MARKED VALUE WHOSE `status` IS NOT A `KC` TOKEN IS THE STORE VERB'S OWN REFUSAL CROSSING BACK
+  // THROUGH THE KERNEL'S OWN LEG** (`constraint-kernel.mjs`'s `attempt.throwState` carries the store's code
+  // at the repair arm): its `status` and `message` cross VERBATIM and `log` is attached BESIDE them —
+  // *"nothing is converted, and a member is added"* (`§2.5` item 10 (ii)).
+  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) {
+    throw {
+      status: refusal.status,
+      message: refusal.message,
+      log: refusalLog(log),
+    };
+  }
+  // **THE KERNEL'S OWN `KC` REFUSAL.** Its `{status, message, log}` is the KERNEL'S OWN three-member form
+  // (`docs/specs/storeroom-constraints/fail-surface.md §1.1`), and it crosses with the STORE's
+  // `FileCommitFailed` in `status` because no caller-side status can carry a `KC` token and a
+  // constraint-refused write is a commit that did not stand: **the kernel token does NOT enter `status`, and
+  // the `log` it carries is the attempt's, VERBATIM.**
   throw {
     status: 'FileCommitFailed',
     message: typeof refusal.message === 'string'
       ? refusal.message
       : 'the write was refused by a constraint of this attempt',
+    log: refusalLog(log),
   };
 }