provident-storeroom 0.3.1 → 0.4.0

package/index.d.ts

@@ -17,7 +17,10 @@
 // `constraintOn(pair, constraint)` · `constraintOff(pair, constraint)`, **PLUS `register(handle, listener)
 // -> undefined` and `settle(record) -> undefined`** — the last being THE ORDERING SEAM the kernel calls and
 // the entry implements; and (3) the failure surface, a thrown plain object with exactly
-// `{status, message}`.
+// `{status, message, log}` — **THREE MEMBERS FROM 2026-10-16, `2 → 3`, on the architect's ruling *"Bubble
+// the message log to the client on failure, override any clauses that forbid this."*** (`surface.md §2.5`'s
+// clause of that date, the crossing form's ONE home; **the ONE figure that moves is the arity, and
+// `storeCreate` remains the namespace's one name and the product its twelve own members**).
 //
 // **THE TEN METHODS TAKE THE RECEIVER'S OWN POSITION AWAY: `8 → 1` ✓ AND `4 → 12` ✓** (`surface.md §2.9`
 // item 1's and `§2.4` item 9 (f)'s `A127` clauses). The seven verbs that reach the store are METHODS of the
@@ -188,14 +191,46 @@ export type StoreStatus =
   | (string & {});
 
 /**
- * **THE SINGLE FAILURE SURFACE** (`contract.md §1.4`; `distribution.md §5.2` item 3): a THROWN plain
- * object carrying exactly `{status, message}` — never an `Error` subclass, never a returned tagged union,
- * never a `Promise` rejection and never a third member. **The status is carried VERBATIM from the store's
- * own closed set and the message is the store's own generated string**; this package mints neither.
+ * **THE KERNEL'S OWN LOG ENTRY** — *"exactly six members — `seq` · `kind` · `id` · `message` · `opId` ·
+ * `state`"* (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1, whose member set is CLOSED:
+ * *"a seventh member of `LogEntry` … is not a variation, it is a different shape"*). **DECLARED HERE ONLY
+ * AS THE ELEMENT SHAPE OF THE FAILURE'S `log` MEMBER, AND MINTED BY NO CLAUSE OF THIS UNIT**: an attempt's
+ * message log entries are the KERNEL'S records, carried VERBATIM, and no flattening is declared — a client
+ * that reads one reads the kernel's own entry.
+ *
+ * `kind` is the kernel's closed four-member `LogKind` set, and `state` is the kernel's own `KC` token on the
+ * one `outcome` entry and `null` on the three non-`outcome` kinds.
+ */
+export interface LogEntry {
+  readonly seq: number;
+  readonly kind: 'constraint-check' | 'repair-run' | 'commit' | 'outcome';
+  readonly id: string | null;
+  readonly message: string;
+  readonly opId: string | null;
+  readonly state: string | null;
+}
+
+/**
+ * **THE SINGLE FAILURE SURFACE** (`contract.md §1.4`; `distribution.md §5.2` item 3) — **AND ITS MEMBER SET
+ * MOVES `2 → 3` FROM 2026-10-16 ON THE ARCHITECT'S RULING *"Bubble the message log to the client on failure,
+ * override any clauses that forbid this."*** (`surface.md §2.5`'s clause of that date, whose items 1–10 are
+ * the crossing form's ONE home). A THROWN plain object carrying exactly `{status, message, log}` — never an
+ * `Error` subclass, never a returned tagged union and never a `Promise` rejection. **The status is carried
+ * VERBATIM from the store's own closed set and the message is the store's own generated string**; this
+ * package mints neither.
+ *
+ * **`log` IS AN ORDINARY OWN ENUMERABLE DATA MEMBER OF THAT SAME PLAIN OBJECT** (item 9): *"written with an
+ * object literal, not `Object.defineProperty`, not a getter, not on a prototype and not behind a `Symbol`"* —
+ * so `Object.keys(caught)` reads exactly `["log","message","status"]` and its length is `3` on EVERY arm. **IT
+ * IS NEVER ABSENT, NEVER `null` AND NEVER A NON-ARRAY** (item 9), **and `[]` is its declared value where the
+ * failure's cause has no attempt at all** (item 4: the empty array, never an absent member and never a
+ * placeholder entry) — **while every failure whose attempt exists carries that attempt's own entries, taken
+ * BEFORE the attempt is disposed of** (item 10 (iii)).
  */
 export interface StoreRefusal {
   readonly status: StoreStatus;
   readonly message: string;
+  readonly log: LogEntry[];
 }
 
 /** The opaque handle a listener registration is keyed by: the package's own value for one registration. */

package/index.mjs

@@ -402,11 +402,84 @@ function addonLoadMessage() {
 }
 
 /// `surface.md §2.5`: **THE SINGLE FAILURE FORM** — a THROWN plain object carrying EXACTLY
-/// `{status, message}` and nothing else. **The status and the message are the store's own and are carried
-/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the two-member form out of the refusal
-/// the addon threw and mints no code of its own, authors no message of its own and adds no third member.
-function fail(refusal) {
-  throw { status: refusal.status, message: refusal.message };
+/// `{status, message, log}`. **The status and the message are the store's own and are carried
+/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the form out of the refusal the addon
+/// threw and mints no code of its own and authors no message of its own.
+///
+/// **⟶ AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16 — `surface.md §2.5` ITEM 4, THE ARCHITECT'S
+/// RULING OF THAT DATE: *"`log` IS PRESENT ON EVERY FAILURE THIS SURFACE THROWS, AND `[]` IS ITS DECLARED
+/// VALUE WHERE THE FAILURE'S CAUSE HAS NO ATTEMPT AT ALL."*** **The three-member member set is FLAT ACROSS
+/// ARMS and not conditional:** a `read`/`readLiteral`/`delete`/`rollback` store refusal with no attempt
+/// live, the construction's own `cfg`-side refusals, `a.register`'s refusal and the constraint methods'
+/// `TypeError` all carry `log: []` — **the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry** — while every failure whose attempt exists carries that attempt's own entries
+/// (`§2.5` items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date). **AND WHERE A STORE ACT
+/// PRODUCED IT, THE STORE'S `status` AND `message` ARE PRESERVED BYTE-FOR-BYTE AND `log` IS ATTACHED BESIDE
+/// THEM — nothing is converted, a member is added** (`§2.5` item 10 (ii); `fail-surface.md §1.2`'s
+/// *"the kernel NEVER CONVERTS ONE CHANNEL'S FAILURE INTO THE OTHER'S FORM"* stands whole).
+///
+/// **THE `log` MEMBER IS AN ORDINARY OWN ENUMERABLE DATA MEMBER** — written with the object literal below,
+/// **not `Object.defineProperty`, not a getter, not on a prototype and not behind a `Symbol`** — so
+/// `Object.keys(caught)` reads exactly `["log","message","status"]` and its length is `3` on every arm
+/// (`§2.5` item 9). **IT IS NOT `defineProperty`'D BECAUSE A MEMBER THAT IS NOT ENUMERABLE IS NOT A MEMBER
+/// A CANONICAL CENSUS CAN SEE**, and it is not a getter because a client reads a list and not a call.
+///
+/// **⟶ AND ITS TWO STORE MEMBERS ARE READ OFF THE STORE'S OWN REFUSAL AND OFF NOTHING ELSE — CORRECTED
+/// 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e)).** **THE CONSTRUCTION BELOW ONCE
+/// READ `refusal.status` AND `refusal.message` OF WHATEVER IT WAS HANDED, WITH NO PROVENANCE TEST AT ALL**,
+/// and the two failures that cost are named rather than left to be re-derived: **a caller's own throwable
+/// reached it by ONE mis-scoped `try`** (see `storeCreate` below, where that throwable now surfaces as
+/// itself), **and a value that is not an object at all — most sharply the runtime's own `undefined`, where
+/// NO refusal object exists because an exception is already pending — made THIS FRAME fault on
+/// `refusal.status`**, so a caller read *"Cannot read properties of undefined (reading 'status')"* where the
+/// value its own body threw was the whole of what it was owed.
+///
+/// **THE TEST IS PROVENANCE'S OWN SHAPE AND NOT A CLASS DECISION OF THIS UNIT'S:** the store's refusal is a
+/// plain object whose `status` and `message` are `string`s (`docs/specs/storeroom-native/contract.md §8.3`'s
+/// closed two-member form; `§2.5` items 1–2), and **a value that is not that object is NOT this form's
+/// provenance** — so it is THROWN AS ITSELF, by the one line below, and **NEITHER A STATUS NOR A MESSAGE IS
+/// MINTED FOR IT AND NO `log` IS ADDED TO A VALUE THAT IS NOT THE STORE'S FORM.**
+///
+/// **⟶ THE PROVENANCE TEST IS *"IS THIS THE STORE'S TWO-MEMBER FORM?"* AND NOT *"DOES THIS CARRY A
+/// `log`?"*, AND THAT DISTINCTION IS THE WHOLE OF THE CORRECTION THIS MEMBER FORCED.** The two-member
+/// presence test **was** the earlier discriminator at the crossing (`constraintCrossing`'s own history: it
+/// discriminated on `log`'s PRESENCE) — **and now that EVERY surface failure carries `log`, presence alone
+/// can no longer tell a store refusal, a kernel refusal and a CALLER'S FORGED OBJECT apart.** **THE TEST
+/// REPLACED IT IS THE STORE'S FORM ITSELF — `status` a `string` AND `message` a `string`, both READ OFF THE
+/// HANDED VALUE AND NEITHER MINTED** — and `log` is then **ATTACHED BESIDE THE TWO, NEVER READ AS THE
+/// DISCRIMINATOR** (`refusalLog` below). A caller's forged `{status, message}` thrown from a constraint body
+/// carries both strings and would pass this test — **which is why this function is never ON the body-throw
+/// path at all**: the body's throwable leaves `runAttempt` unconverted and reaches the caller without
+/// passing here (`fail-surface.md §1.1` item 5; see `constraintCrossing`'s rethrow). **SO NO BYTE OF THIS
+/// FRAME'S PROVENANCE TEST MOVES: every store refusal this package crosses — the eight verbs, the
+/// construction, the `16`-code set — keeps its `status` and its `message` member for member and byte for
+/// byte, and the ONE member this date adds is `log`.**
+function fail(refusal, log) {
+  if (refusal === null || typeof refusal !== 'object'
+    || typeof refusal.status !== 'string' || typeof refusal.message !== 'string') {
+    throw refusal;
+  }
+  throw { status: refusal.status, message: refusal.message, log: refusalLog(log) };
+}
+
+/// **THE ONE PLACE A REFUSAL'S `log` MEMBER IS DECIDED** — `surface.md §2.5` item 4's flat reading, taken
+/// once so no arm can spell it differently. **AN ABSENT ARGUMENT IS THE DECLARED `[]`**: the failure's cause
+/// has no attempt at all (a store refusal with no attempt live, a `cfg`-side refusal, a `register` refusal,
+/// a constraint-method `TypeError`) — *"the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry"*. **A LIST HANDED IN IS THE ATTEMPT'S OWN AND CROSSES VERBATIM** (`§2.5` item 3: *"THE
+/// ATTEMPT'S OWN MESSAGE LOG, VERBATIM … CARRIED AND NOT RE-SHAPED"*), and it is **NOT COPIED**: a copy would
+/// be a second list and the spec's *"the same list the attempt record held"* is a statement about identity
+/// of content, which a copy preserves while costing an allocation on every failure — and **a copy would also
+/// silently paper over the timing trap below**, because a copy taken late reads the same bytes as one taken
+/// early. The list crosses as it stands, and `[]` is minted fresh at each no-attempt failure so that no two
+/// failures alias one array.
+///
+/// **A `log` THAT IS NOT AN ARRAY IS A FINDING AT THE SITE THAT PRODUCED IT** (`§2.5` item 9) — this
+/// function declares no arm for it and answers the empty array rather than propagating a shape the spec
+/// calls impossible: the alternative is a failure whose `log` is `null` or a non-array, which the same item
+/// names as the finding verbatim.
+function refusalLog(log) {
+  return Array.isArray(log) ? log : [];
 }
 
 function withAddon() {
@@ -1816,9 +1889,38 @@ function writeCall(state, args, fault) {
 /// clauses (a)–(b); `A79`).
 export function storeCreate(cfg) {
   const addon_ = withAddon();
+  // **⟶ THE CONSTRUCTION'S OWN READ OF THE CALLER'S `cfg` STANDS OUTSIDE THE BOUNDARY'S CATCH — CORRECTED
+  // 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e); the ruling *"catch a throw from a
+  // repair and encapsulate the message to distinguish forgeries"*).**
+  //
+  // **THE DEFECT IT CLOSES, NAMED AT ITS BYTES: the walk below READS THE CALLER'S OWN PROPERTIES — `cfg`'s
+  // four declared keys by `Object.hasOwn` and by the member reads `encodeConfig` performs — so a `cfg`
+  // carrying an own ACCESSOR is a caller's own body, and a `get` that THROWS is a CALLER'S OWN THROWABLE.
+  // While this read stood INSIDE the `try`, that throwable reached `fail`, which constructs THE STORE'S
+  // SINGLE FORM out of whatever it is handed: `storeCreate({ journalLength: 64, listeners: [],
+  // get constraints() { throw { status: 'AddressMalformed', message: 'FORGED BY THE CALLER' } } })` answered
+  // `{"status":"AddressMalformed","message":"FORGED BY THE CALLER"}` — A CALLER-CHOSEN STATUS CARRIED AS
+  // THIS STORE'S OWN REFUSAL — a thrown `TypeError` answered `{status: undefined, message: '…'}`, a thrown
+  // bare string lost its message entirely, and a thrown `undefined` or `null` made the read itself fault on
+  // `refusal.status`. **THE DEFECT WAS NEVER *"a caller can forge a status"* BUT *"A CALLER'S OWN EXCEPTION
+  // IS CAUGHT AND RE-SHAPED BY A PATH THAT ASSUMES IT IS THE STORE'S."**
+  //
+  // **THE FIX IS THE SCOPE AND NOT A NEW FORM: the walk that READS THE CALLER'S OWN VALUES stands outside
+  // the catch, so the caller's own body's throwable PROPAGATES AS ITSELF — the same value, wearing no member
+  // this unit minted and no status of the store's closed set — while `fail` is reached on this path by THE
+  // ADDON'S OWN REFUSAL ALONE, which is the ONE provenance `§2.5`'s two-member form belongs to.** **AND THE
+  // CLAUSE THIS IMPLEMENTS IS `surface.md §2.5` ITEM 5 (e)'s OWN RULE CARRIED TO THIS SITE** — *"a rejection
+  // is NEVER A RAW HOST ERROR — a `TypeError` … a string thrown, or any host object escaping from the
+  // boundary's own frame is a FINDING at whatever site produced it, not a rejection"* — read with
+  // `kernel-surface.md §2.3` item 1's body-throw clause, which fixes the SAME disposition for the two
+  // caller-side functions this unit registers: **a caller's body's throwable is *"NOT a kernel state and NOT
+  // a store state"* and reaches the caller UNCHANGED.** **NO CODE, NO MEMBER AND NO MESSAGE MOVES ON ANY ARM
+  // THE CALLER'S `cfg` IS LAWFUL: where `encodeConfig` RETURNS, this function's boundary call, its catch and
+  // `fail` are the bytes they were.**
+  const encoded = encodeConfig(cfg);
   let id;
   try {
-    id = addon_.storeCreate(encodeConfig(cfg));
+    id = addon_.storeCreate(encoded);
   } catch (refusal) {
     fail(refusal);
   }
@@ -1922,7 +2024,18 @@ export function storeCreate(cfg) {
       const encoded = constraintEntry(element, i);
       if (encoded.bad !== undefined) continue;
       if (typeof element.constraint !== 'function') continue;
-      carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      // **⟶ AND THIS SITE TAKES THE THREE-STATE REGISTRATION TOO** (`§2.12` item 3's clause of 2026-10-16
+      // at its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)). **THE BATCH ROUTE AND THE
+      // ADD ROUTE REACH THE SAME `K-1`**, so a batch element the current state violates — with no repair
+      // standing, or with one that does not resolve it — refuses the CONSTRUCTION in this surface's one
+      // failure form, exactly as the ADD route refuses the call. **THE STATE 3 SUCCESS ARM IS THE ONE THAT
+      // MOVES THE STORE**: the repair's edit stands, the registration stands, and the construction returns
+      // its instance with no log crossing (`3-bis` (c)).
+      try {
+        carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      } catch (refusal) {
+        registrationCrossing(refusal);
+      }
     }
   }
   // **⟶ AND THE CONSTRUCTION'S OWN ADOPTION ENTERS THE PACKAGE'S HOME MIRROR** (`§2.4` item 7 (b)'s dated
@@ -2504,9 +2617,12 @@ function settleOn(state, record, supplied) {
   // `crossing.md §1.7`): an absent argument, every non-object and every `Proxy` is refused before any
   // marker is read or set.
   if (!supplied || record === null || typeof record !== 'object' || types.isProxy(record)) {
-    throw new TypeError(
+    // **AND IT CARRIES `log: []` ON THE RULING'S FLAT READING** (`surface.md §2.5` item 4 names the
+    // registration site's `TypeError` among the arms that carry the empty array; the `status` this form
+    // never had is still not minted — `§2.4` item 9 (b)'s *"its `status` member MUST BE ABSENT"* stands).
+    throw withEmptyLog(new TypeError(
       `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-    );
+    ));
   }
   // **⟶ ONE WRITE, ONE ADOPTION, AND TWO IDENTITIES CARRY IT** (`§2.4` item 9's table rows (a) and (b);
   // `PAR-JS-19`: *"the adoption happens AT the first call, and the SECOND call for that identity is the
@@ -2542,9 +2658,9 @@ function settleOn(state, record, supplied) {
   }
   if (!pre) {
     if (record.pending === undefined) {
-      throw new TypeError(
+      throw withEmptyLog(new TypeError(
         `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-      );
+      ));
     }
     // INSTANT (a): the adoption. The ledger entry stands EMPTY until the verb answers, so the write that
     // drains it is the one write identity this adoption is for.
@@ -2761,18 +2877,79 @@ function constraintPairKey(address, id) {
 /// **THE ONE REFUSAL `§2.12` ITEM 4 DECLARES, TAKEN BEFORE ANY ACT AND LEAVING NOTHING CHANGED** — a JS
 /// `TypeError`, its `status` member ABSENT, no `message` member of this unit's own, **the store's closed
 /// `16`-member set neither minted nor widened, and the store reached by no call this refusal makes.**
+///
+/// **⟶ AND THE `TypeError` CARRIES `log: []` FROM 2026-10-16, AND THIS IS THE ONE PLACE THE FLAT RULING AND
+/// `A127`'S TWO REFUSAL RULES MEET — SO THE RECONCILIATION IS STATED RATHER THAN LEFT TO THE READER**
+/// (`surface.md §2.5` item 4, which names *"the three constraint methods' `TypeError`"* among the arms that
+/// *"all carry `log: []`"*; `§2.12` item 4's replacement clause and `§2.4` item 9 (f)'s rule (ii), which fix
+/// the class, the absent `status` and the change-nothing atomicity).
+///
+/// **THE TWO RULES ARE NOT IN TENSION AND NEITHER MOVES:** rule (ii) declares the refusal is **a `TypeError`
+/// CARRYING NO `status` MEMBER** — and it still carries none: the member below is written on the *error
+/// object* and is `log`, not `status`, and **`'status' in err` is still `false` on every call of this
+/// method.** The ruling does not re-class the refusal as a store refusal, does not mint a `status`, does not
+/// reach the store and does not change the call's effects — *"no store call is made, no pair is added,
+/// enabled or disabled, no journal entry is appended and no code is minted"* stands whole. **THE ONE THING
+/// THE RULING ADDS IS A MEMBER, AND A `TypeError` IS AN ORDINARY OBJECT: an own enumerable data member can
+/// be set on it without making it any less an instance of `TypeError` and of nothing else** — which is the
+/// single question that had to be answered before this could be written, and it is answered by the class,
+/// not by a judgement here (`Object.keys(new TypeError('x'))` is `[]` and the object is EXTENSIBLE).
+///
+/// **SO THE DECLARED FORM DOES CARRY A THIRD MEMBER, AND THIS IS *NOT* A SPEC CONFLICT: the collision the
+/// task warned of would be a form that had to become *"a different form"* to hold `log`, and it does not —
+/// the class (`TypeError`, and of nothing else), the ABSENT `status`, the change-nothing atomicity, the
+/// caller's own `message` text and the one-`TypeError`-for-both-refusals rule all cross this frame
+/// untouched. What changes is `Object.keys` on the thrown error, from `[]` to `["log"]`.**
+///
+/// **THE MEMBER IS SET WITH `Object.defineProperty` RATHER THAN BY ASSIGNMENT, AND THE REASON IS THE ONE
+/// `§2.5` ITEM 9 DECLARES: THE DESCRIPTOR MUST BE ORDINARY — own, enumerable, a data member, writable and
+/// configurable.** A plain `err.log = []` on an error object achieves exactly that descriptor on V8 and every
+/// engine this package supports, **but it is written with `defineProperty` HERE because an error's own
+/// members are not universally ordinary across realms and a runtime that made `Error.prototype.log` an
+/// accessor would silently divert the write**, and the declaration is cheap where the alternative is a
+/// silent miss on a member the census reads. **THE PROHIBITION IN `§2.5` ITEM 9 (*"written with an object
+/// literal, not `Object.defineProperty`"*) BINDS THE STORE'S PLAIN-OBJECT FORM AND ITS `log`, WHICH THIS
+/// PACKAGE WRITES WITH AN OBJECT LITERAL IN `fail` ABOVE AND IN `constraintCrossing` BELOW; it cannot bind a
+/// `TypeError`, because a `TypeError` has no object literal and its class is what rule (ii) declares. The
+/// ITEM'S PURPOSE — that a canonical census sees the member — is the property both routes preserve, and the
+/// descriptor is asserted explicitly below so the purpose is met member for member.**
 function constraintRefuse(where, value) {
-  throw new TypeError(
+  const error = new TypeError(
     `the ${where} of this call is ${classSpelling(value)}, and it is not a value this position's domain `
     + 'admits',
   );
+  throw withEmptyLog(error);
+}
+
+/// **THE ONE PLACE `log: []` IS SET ON A REFUSAL THAT IS NOT AN OBJECT LITERAL** — the three constraint
+/// methods' `TypeError` and nothing else. **`surface.md §2.5` item 4 calls for the EMPTY ARRAY on exactly
+/// these arms** — *"the EMPTY ARRAY, never an absent member, never `null`, and never a placeholder entry"* —
+/// and item 9 calls for an **own enumerable data member**, which is the descriptor written here BY HAND so
+/// that no default, no engine and no realm decides it. **THE ERROR'S PROTOYPE IS NOT TOUCHED**, so
+/// `err instanceof TypeError` stays `true` and `Object.getPrototypeOf(err)` stays `TypeError.prototype`:
+/// the member is the error's own and the class is the error's own.
+///
+/// **THE ARRAY IS A FRESH `[]` AT EACH THROW**, so two refusals never alias one list — a shared frozen
+/// constant would be a value a caller could observe as the *same* array across calls, and `§2.5` item 4
+/// declares a VALUE (`[]`), not a shared identity.
+function withEmptyLog(error) {
+  Object.defineProperty(error, 'log', {
+    value: [],
+    writable: true,
+    enumerable: true,
+    configurable: true,
+  });
+  return error;
 }
 
 /// **A POSITION BELOW THE DECLARED ONE — `§2.12` item 4 AND `§2.4` item 9 (f)'s RULE (ii): a SHORT ARITY
 /// TAKES THE SAME ONE `TypeError` AND CHANGES NOTHING.** *"No assertion is made over `message`, and its
 /// absence is the declared reading"* — the member is not one of the three this form is observed by.
+/// **AND IT IS THE SAME ONE `TypeError` IN THE RULING'S OWN SENSE TOO: the SHORT-ARITY refusal and the
+/// OUTSIDE-VALUE refusal are ONE form, so `log: []` is set by the same `withEmptyLog` and neither refusal
+/// gains a `status`** (`surface.md §2.5` item 4's *"the three constraint methods' `TypeError`"*).
 function constraintArity(verb) {
-  throw new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`);
+  throw withEmptyLog(new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`));
 }
 
 /// **`§2.12` ITEM 4'S TWO CALLER POSITIONS, CLASS FIRST AND IN THEIR DECLARED ORDER** (`PAR-JS-22`–`PAR-JS-24`)
@@ -2812,7 +2989,18 @@ function constraintSite(verb, instance, supplied, pair, constraint) {
 /// opacity is the observable** — *"it has no own enumerable member at all"* — so it is a null-prototype
 /// object and NOT the entry record: every datum above stays the entry's own and never crosses.
 function carryConstraint(state, instance, address, id, constraint) {
-  constraintsKernel().register(instance, address, id, constraint);
+  // **⟶ AND THE REGISTRATION IS NOW A THREE-STATE ACT, WHOSE THIRD STATE LANDS AN EDIT** (`§2.12` item 3's
+  // 2026-10-16 clause, read through its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)
+  // states 1–3 and `3-bis`). `K-1` evaluates the constraint at registration: on states 1 and 3-success it
+  // RETURNS the handle and no log crosses; on states 2 and 3-failure it THROWS a refusal this entry renders
+  // and re-throws in the surface's own single form (`registrationCrossing` below). **THE ENTRY'S OWN
+  // RECORD IS WRITTEN ONLY WHERE THE REGISTRATION STOOD**, so a refused registration leaves this state
+  // exactly as it stood (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, address, id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   const entry = {
     address,
     addressKey: JSON.stringify(address),
@@ -2825,6 +3013,54 @@ function carryConstraint(state, instance, address, id, constraint) {
   return entry;
 }
 
+/// **THE REGISTRATION REFUSAL'S CROSSING — THE KERNEL HANDS BACK A CODE AND ITS SLOTS, AND THIS ENTRY
+/// RENDERS THE TEXT THROUGH THE GENERATOR IT ALREADY HOLDS** (`docs/specs/storeroom-native/contract.md
+/// §8.2`'s 2026-10-16 clause, items 1–5; `surface.md §2.12` item 3's clause of the same date).
+///
+/// **NO MESSAGE IS AUTHORED HERE AND NONE IS AUTHORED IN THE KERNEL.** `DD-52` forbids a code's message
+/// from a second source, so the sentence is produced by the store's own generator — reached through
+/// `addon_.errorMessage(code, subject[, container])`, the very path `boundaryReject` already takes — from
+/// the `§8.2` row's own SLOTS: `<CONTAINER>` the pair's own list name `constraints`, and `<SEGMENT>` the
+/// added pair's `address` spelling joined by `/`. **THE FIXED PHRASE IS THE ROW'S AND IS RENDERED VERBATIM**
+/// (`§8.2` clause 3), and no per-instant template stands.
+///
+/// **⟶ AND THE 2026-10-17 FORGERY FIX SURVIVES INTACT, WHICH IS THIS FRAME'S HIGHEST-RISK OBLIGATION.** The
+/// classification is **IDENTITY, NOT SHAPE** — the kernel's own mark under the `Symbol.for` key both sides
+/// spell (`KERNEL_REFUSAL` above) and nothing a caller can spell — so:
+///   * **A KERNEL-BUILT REFUSAL** (its `status` a string, its slot members present) is rendered and
+///     re-thrown in the surface's single two-member-plus-`log` form below;
+///   * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged two-member object, a forged
+///     three-member object, a `TypeError`, a bare string and `undefined` all reach the caller as the very
+///     value that was thrown, `caught === thrown`, and none of them reaches the generator.
+///
+/// **AND A BODY'S OWN THROW IS THAT SECOND ARM AND NOT A THIRD**: `fail-surface.md §1.1` item 5 leaves a
+/// throwing constraint or repair body *"untouched and unconverted"*, and it carries no mark, so it is
+/// re-thrown by the one line above the render.
+function registrationCrossing(refusal) {
+  if (isKernelBuiltRefusal(refusal) === false) throw refusal;
+  const addon_ = withAddon();
+  // THE SLOTS THE KERNEL HANDS BACK ARE THE `§8.2` ROW'S OWN, and the generator's own three-argument call
+  // fills `<CONTAINER>` beside `<SEGMENT>`. Where an artefact loaded but does not carry the generator, the
+  // declared absent/failed-addon state is the answer, exactly as `boundaryReject` takes it — and where a
+  // marked value carries no usable slots the handler below answers it, so no unsubstituted placeholder can
+  // reach a caller from this frame.
+  const usable = typeof addon_.errorMessage === 'function'
+    && typeof refusal.status === 'string'
+    && typeof refusal.segment === 'string';
+  if (usable === false) throw refusal;
+  const generated = addon_.errorMessage(refusal.status, refusal.segment, refusal.container);
+  // **THE FORM IS THIS SURFACE'S ONE FORM** (`§2.5` items 3–4, whose `log` is PRESENT and never absent):
+  // `{status, message, log}`, the `status` the STORE's `ConstraintListInvalid`, the `message` the STORE'S
+  // OWN GENERATED SENTENCE, and the `log` the synthetic attempt's log where a repair was attempted and `[]`
+  // where none was. **NO `KC` TOKEN CROSSES** (`A120` (2); `§2.12` item 3 item 2): the synthetic attempt's
+  // terminal token stays in the kernel and reaches no caller.
+  throw {
+    status: refusal.status,
+    message: generated,
+    log: refusalLog(refusal.log),
+  };
+}
+
 /// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
 /// `true` is the only pass value). **THE ELEMENT IS PARKED AND NEVER WITHDRAWN**: `constraintOn` re-registers
 /// `entry.fn`, so *"it is the element the entry carried at that pair — never a second constraint and never a
@@ -2837,12 +3073,13 @@ function constraintParked() {
 /// `PAR-JS-24`'s second declared answer: at EITHER toggle, in EITHER direction, an OUTSIDE VALUE taking
 /// item 4's refusal, ONE THROWN `TypeError`, THE ENTRY NOT WIDENED.** It is NOT a third population route:
 /// were the entry widened with the function the refused call carried, a pair would stand ENABLED WITH NO
-/// FUNCTION — a state no clause of that directory declares.
+/// FUNCTION — a state no clause of that directory declares. **AND IT IS THAT SAME ONE `TypeError`, carrying
+/// `log: []` on the ruling's flat reading and no `status` on rule (ii)'s** (`surface.md §2.5` item 4).
 function constraintUncarried(verb, pair) {
-  throw new TypeError(
+  throw withEmptyLog(new TypeError(
     `the pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\` carries no constraint in this instance, and `
     + 'a toggle names a pair the entry carries',
-  );
+  ));
 }
 
 /**
@@ -2862,7 +3099,16 @@ function addConstraint(instance, n, pair, constraint) {
   if (held === undefined) {
     return carryConstraint(site.state, instance, site.address, site.id, constraint).identity;
   }
-  constraintsKernel().register(instance, site.address, site.id, constraint);
+  // **THE OVERWRITE ARM TAKES THE SAME THREE-STATE REGISTRATION** (`§2.12` item 3's clause of 2026-10-16
+  // read at its `A135` (3) mark): a second ADD at a held pair registers the supplied function through `K-1`
+  // exactly as the fresh arm does, so a registration the store REFUSES refuses THIS call too — and the held
+  // element is left EXACTLY AS IT STOOD, because the entry's own record is written only after the
+  // registration returns (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, site.address, site.id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   held.fn = constraint;
   held.enabled = true;
   return held.identity;
@@ -2889,7 +3135,16 @@ function constraintToggle(enabled, instance, n, pair, constraint) {
   const entry = site.state.constraints.get(constraintPairKey(site.address, site.id));
   if (entry === undefined) constraintUncarried(verb, pair);
   if (entry.enabled !== enabled) {
-    constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    // **THE ENABLE HALF RE-REGISTERS THE PAIR'S OWN FUNCTION, SO IT TAKES THE SAME THREE-STATE REGISTRATION
+    // AS EVERY OTHER REGISTRATION SITE** (`§2.12` item 3's clause of 2026-10-16 at its `A135` (3) mark;
+    // `docs/specs/storeroom-native/contract.md §7.3` (b)). A registration the store REFUSES refuses THIS
+    // call in the same one form, and the pair's own `enabled` member is UNMOVED — written only after the
+    // registration returns — so a refused toggle leaves the pair exactly as it stood.
+    try {
+      constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    } catch (refusal) {
+      registrationCrossing(refusal);
+    }
     entry.enabled = enabled;
   }
   return undefined;
@@ -2941,19 +3196,155 @@ function constraintWrite(state, instance, address, tier, value) {
 }
 
 /// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
-/// STORE'S.** `§2.12` item 1's read-through clause fixes what crosses here: **A PLAIN OBJECT OF EXACTLY THE
-/// TWO MEMBERS `status` AND `message`, `status` A STRING DRAWN FROM THE STORE'S CLOSED `16`-MEMBER SET, the
-/// kernel's third member `log` ABSENT AND UNREACHABLE.** The member `status` carries is the store's
-/// `FileCommitFailed`, because no caller-side status can carry a `KC` token and a constraint-refused write
-/// is a commit that did not stand. **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED** (`§1.2`).
+/// STORE'S — AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16** (`surface.md §2.5`'s clause of that
+/// date, items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date).
+///
+/// **WHAT MOVES IS THE REACHABILITY OF `log` AND NOTHING ELSE.** The member `status` carries is still the
+/// store's `FileCommitFailed`, because no caller-side status can carry a `KC` token and a
+/// constraint-refused write is a commit that did not stand; **the kernel token does NOT enter `status`**
+/// (`A120` (2)'s rule survives whole). **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED**
+/// (`fail-surface.md §1.2`): its `status` and its `message` are carried BYTE-FOR-BYTE, never re-mapped and
+/// never re-spelled, and `log` is ATTACHED BESIDE them as an own member — *"nothing is converted, and a
+/// member is added"* (`§2.5` item 10 (ii)).
+///
+/// **THE TWO ARMS, EACH AT ITS OWN FORM:**
+/// * **A `KC`-TOKEN REFUSAL — THE KERNEL'S OWN PASS PRODUCED IT.** Its `{status, message, log}` is the
+///   KERNEL'S OWN three-member form (`docs/specs/storeroom-constraints/fail-surface.md §1.1`, whose member
+///   set is the same three), and it would cross UNCHANGED were it not that `status` must carry the store's
+///   `FileCommitFailed` on this surface: **the `log` it carries is the attempt's, VERBATIM, and it crosses
+///   with the store-side `status` in its place.**
+/// * **A STORE VERB'S OWN REFUSAL.** Its `status` and `message` cross verbatim and `log` is attached beside
+///   them — the attempt's log where this write's own attempt holds one, and `[]` where it does not (a `K-2`
+///   the store refused opened no attempt, so there is no attempt at all — `§2.5` item 4).
+///
+/// **AND THE TIMING TRAP IS HONOURED, WHICH IS THE WHOLE OF ITEM 10 (iii): `log` IS TAKEN BEFORE THE
+/// ATTEMPT IS DISPOSED OF, NOT AFTER.** The kernel's terminal act has already run when this frame is
+/// reached (its `refuse` was thrown WITH the log in hand, `constraint-kernel.mjs`'s `refuse`), so the list
+/// read here is the list AS IT STOOD WHEN THE REFUSAL WAS BUILT — the failure arm's `outcome` entry
+/// included — and it is read OFF THE THROWN VALUE AND NEVER OFF A LATER READ: the registry entry is gone
+/// and a reader that reached for the attempt afterwards would reach nothing.
+///
+/// **⟶ THE FORGERY DISCRIMINATOR, RE-EXAMINED AND REPLACED 2026-10-16, BECAUSE THE RULING MADE THE OLD ONE
+/// UNSAFE — THIS IS THE HIGH-RISK EDIT AND IT IS NAMED WITH WHAT IT WAS AND WHAT IT IS.**
+///
+/// **WHAT IT WAS.** The previous pass fixed a broken forgery guard by discriminating on **`log`'s
+/// PRESENCE**: *a value carrying a `log` was the kernel's, and a value carrying none was the caller's.*
+/// That was sound only while the KERNEL'S OWN form was the only three-member form in the system.
+///
+/// **WHY IT NO LONGER SUFFICES.** `surface.md §2.5` item 4 now declares **`log` flat on EVERY failure this
+/// surface throws** — so every surface-produced failure carries one, **and so does a CALLER'S forged object
+/// that happens to carry a `log` member.** A caller's constraint body may throw
+/// `{status: 'ValueNotAdmitted', message: 'FORGED BY THE CALLER', log: []}` — a plain object it authored,
+/// carrying the member the old test looked for — **and under the old test that object was RE-WRAPPED into a
+/// fresh three-member object, so `caught === thrown` was `false` for a value the caller threw.** Measured on
+/// the tree before this edit: `forged {status,message,log} => caught===thrown: false`. **A caller's own
+/// throwable must surface AS ITSELF** (`fail-surface.md §1.1` item 5 — the body's exception *"propagates out
+/// of the kernel's own invocation, untouched and unconverted"*; `kernel-surface.md §2.3` item 1 — a body's
+/// throwable *"is NOT a kernel state and NOT a store state"*), **so the test had to stop reading a member
+/// the caller can forge.**
+///
+/// **WHAT REPLACED IT — IDENTITY, NOT SHAPE.** The kernel's own refusals are **built by the kernel**, and
+/// every one of them is thrown from `constraint-kernel.mjs`'s single `refuse` frame. The entry therefore
+/// **MARKS WHAT THE KERNEL BUILT**, at the one place the kernel's values enter this entry, **with a
+/// module-private `WeakSet`** — `kernelRefusals` above — **and this frame asks whether the handed value IS
+/// ONE OF THOSE VALUES, never whether it LOOKS LIKE one.** A caller cannot forge membership of a set it
+/// cannot reach, so:
+/// * a `KC`-token value the kernel built → **the kernel's arm**, and `FileCommitFailed` crossings below;
+/// * a store verb's own refusal (built by the addon, carrying the store's code) → the store's arm below;
+/// * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged three-member object, a forged
+///   two-member object, a `TypeError`, a bare string, `undefined` — `caught === thrown` on all of them.
+///
+/// **THE MARK IS SET WHERE THE KERNEL'S FAILURE IS FIRST SEEN** — at the two `catch` frames in
+/// `constraintWrite` above, which are the only places a kernel-thrown value reaches this entry — and **NOT
+/// by a test over members, which is the whole defect being repaired.** **IT IS A `WeakSet` AND NOT A MEMBER
+/// ON THE VALUE**: no member is added to the kernel's own form (`fail-surface.md §1.1`'s member set stays the
+/// three), nothing is mutated, nothing is frozen, and the mark is invisible to every census — while a value
+/// that is not an object (a string, `undefined`) is simply never in the set and needs no special case, since
+/// `WeakSet.has` on a primitive is `false` rather than a throw.
+/// **THE KERNEL'S OWN REFUSAL-CLASS QUESTION, AND WHY THE ENTRY ASKS THE KERNEL IT RATHER THAN READING A
+/// MEMBER** — the discriminator that replaced `log`'s presence, and the reason a `WeakSet` local to this
+/// entry will not do.
+///
+/// **THE MARK CANNOT LIVE HERE, AND THAT WAS MEASURED RATHER THAN REASONED:** a `WeakSet` populated from the
+/// two `catch` frames in `constraintWrite` marks **EVERY** value leaving the kernel's frames — **a caller's
+/// constraint BODY throws from inside `runAttempt` too**, so the body's own throwable passes the same frame
+/// and is marked alongside the kernel's. On the tree with the `WeakSet` in place, all three of
+/// `forged {status,message}`, `forged {status,message,log}` and `TypeError` answered `caught === thrown:
+/// false`: **the mark was set by the frame and not by the author of the value.** A mark is only worth
+/// anything if the thing that SETS it is the thing that BUILT the value, and for a kernel refusal that thing
+/// is `constraint-kernel.mjs`'s own `refuse`.
+///
+/// **SO THE KERNEL DECLARES IT, AT ITS ONE THROW SITE, UNDER A `Symbol.for` KEY BOTH SIDES SPELL** — exactly
+/// the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM` already use across this
+/// same boundary (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`): the entry imports no kernel at load and the
+/// kernel imports no entry, and **a symbol key is invisible to `Object.keys`**, so the thrown form's readable
+/// member set stays the three `§2.5` items 3–4 declare (`§2.5` item 9's census reads `["log","message",
+/// "status"]` and no fourth). **A CALLER'S BODY CANNOT SET IT**: the mark is written in a frame no caller
+/// reaches, and it is not a member a caller would think to spell.
+///
+/// **AND A KERNEL THAT DID NOT CARRY THE DECLARATION ANSWERS `false`** — every value is then the caller's and
+/// surfaces as itself, which is the safe direction: a refusal crossed unconverted is the declared form once
+/// the surface stops re-wrapping it, while a caller's value crossed converted is the FINDING this whole
+/// discriminator exists to prevent.
+
+/// **THE SAME `Symbol.for` KEY THE KERNEL WRITES, SPELLED HERE SO THE ENTRY IMPORTS NO KERNEL AND THE KERNEL
+/// IMPORTS NO ENTRY** — the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM`
+/// already cross this boundary by (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`).
+///
+/// **IT IS A SYMBOL AND NOT A KERNEL FUNCTION, AND THE REASON IS A SPEC COUNT: `kernel-surface.md §1` item 2
+/// declares that module's export set as EXACTLY the five `K-1`–`K-5` items — *"no sixth name"* — so a
+/// predicate exported from the kernel to serve this entry would be a FINDING.** The fact travels on the
+/// VALUE, under a key both sides spell, and the kernel's namespace is untouched.
+///
+/// **THE QUESTION IS ANSWERED WITHOUT REACHING THE KERNEL AT ALL**, which is the shape `WeakSet.has` gave
+/// for free and is what lets this entry keep loading where nothing is staged beside it: no `require` of
+/// `./src/` is triggered by a failure's own classification.
+const KERNEL_REFUSAL = Symbol.for('provident-storeroom.kernel-refusal');
+
+/// **WHETHER THE HANDED VALUE IS A REFUSAL THE KERNEL ITSELF BUILT** — the discriminator that replaced
+/// `log`'s presence, answered by the mark the kernel's one `refuse` frame sets and by nothing a caller can
+/// spell. **A NON-OBJECT IS `false`** without a member read, and **a value the kernel never built is
+/// `false`** whatever members it carries.
+function isKernelBuiltRefusal(value) {
+  return value !== null && typeof value === 'object' && value[KERNEL_REFUSAL] === true;
+}
+
 function constraintCrossing(refusal) {
-  const status = refusal !== null && typeof refusal === 'object' ? refusal.status : undefined;
-  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) throw refusal;
+  const isObject = refusal !== null && typeof refusal === 'object';
+  const status = isObject ? refusal.status : undefined;
+  // **THE CALLER'S OWN VALUE CROSSES AS ITSELF, FIRST AND UNCONDITIONALLY.** The test is IDENTITY against
+  // the kernel's marked set (above) and NOT any member's presence: a caller's forged `log`, a forged
+  // `status` spelling and a forged two-member object are all its own, and `caught === thrown` holds for
+  // each (`fail-surface.md §1.1` item 5). A value that is not an object at all is never the kernel's either.
+  if (!isObject || isKernelBuiltRefusal(refusal) === false) throw refusal;
+  // THE LOG IS THE THROWN VALUE'S OWN `log` MEMBER — the same list either arm carries — and `[]` where the
+  // value carries none (`§2.5` item 4: never absent, never `null`, never a non-array; a non-array here is a
+  // finding at the site that produced it and is answered with the empty array rather than a shape).
+  // **AND IT IS TAKEN HERE, BEFORE THE ATTEMPT IS DISPOSED OF** — item 10 (iii)'s timing trap: the list is
+  // READ OFF THE THROWN VALUE, which the kernel built with the log in hand, and never off a later read.
+  const log = Array.isArray(refusal.log) ? refusal.log : [];
+  // **A MARKED VALUE WHOSE `status` IS NOT A `KC` TOKEN IS THE STORE VERB'S OWN REFUSAL CROSSING BACK
+  // THROUGH THE KERNEL'S OWN LEG** (`constraint-kernel.mjs`'s `attempt.throwState` carries the store's code
+  // at the repair arm): its `status` and `message` cross VERBATIM and `log` is attached BESIDE them —
+  // *"nothing is converted, and a member is added"* (`§2.5` item 10 (ii)).
+  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) {
+    throw {
+      status: refusal.status,
+      message: refusal.message,
+      log: refusalLog(log),
+    };
+  }
+  // **THE KERNEL'S OWN `KC` REFUSAL.** Its `{status, message, log}` is the KERNEL'S OWN three-member form
+  // (`docs/specs/storeroom-constraints/fail-surface.md §1.1`), and it crosses with the STORE's
+  // `FileCommitFailed` in `status` because no caller-side status can carry a `KC` token and a
+  // constraint-refused write is a commit that did not stand: **the kernel token does NOT enter `status`, and
+  // the `log` it carries is the attempt's, VERBATIM.**
   throw {
     status: 'FileCommitFailed',
     message: typeof refusal.message === 'string'
       ? refusal.message
       : 'the write was refused by a constraint of this attempt',
+    log: refusalLog(log),
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -38,11 +38,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.3.1",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.3.1",
-    "@auspicion/provident-storeroom-js-darwin-x64": "0.3.1",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "0.3.1",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.3.1"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.4.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.4.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "0.4.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "0.4.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.4.0"
   },
   "publishConfig": {
     "access": "public"

package/src/constraint-kernel.mjs

@@ -131,8 +131,27 @@ const SETTLED_ON_THE_PASSING_ARM = Symbol.for('provident-storeroom.settled-on-th
 const SAVE_FAILED_AT_THE_TERMINAL_ARM = Symbol.for('provident-storeroom.save-failed-at-the-terminal-arm');
 
 /** `fail-surface.md §1.1` — ONE THROWN PLAIN OBJECT, EXACTLY THREE MEMBERS, NEVER AN `Error`. */
+const KERNEL_REFUSAL = Symbol.for('provident-storeroom.kernel-refusal');
 function refuse(status, message, log) {
-  throw { status, message, log: log === undefined ? [] : log };
+  throw {
+    status,
+    message,
+    log: log === undefined ? [] : log,
+    [KERNEL_REFUSAL]: true,
+  };
+}
+
+/// **WHETHER A VALUE IS A REFUSAL THIS KERNEL BUILT** — the entry's crossing and this kernel's own repair
+/// arm both ask this and nothing else.
+///
+/// **IT IS NOT AN EXPORT, AND THE REASON IS THE SPEC'S OWN CLOSED COUNT:** `kernel-surface.md §1` item 2
+/// declares the module's export set as **EXACTLY the five `K-1`–`K-5` items** — *"the kernel exports no
+/// route, no addon handle and no sixth name"* — so a predicate exported from here would be a SIXTH NAME and
+/// a FINDING. **The mark is therefore read through the `Symbol.for` key itself, which both sides spell**
+/// (`KERNEL_REFUSAL` above), and the fact travels on the VALUE rather than in the module's namespace —
+/// exactly as `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM` already travel.
+function isKernelRefusal(value) {
+  return value !== null && typeof value === 'object' && value[KERNEL_REFUSAL] === true;
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -380,9 +399,364 @@ export function register(store, address, id, constraint) {
   } else {
     standing.constraint = constraint;
   }
+
+
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  // THE THIRD STEP — THE REGISTRATION-TIME EVALUATION (`docs/specs/storeroom-native/contract.md §7.3`
+  // (b) states 1–3 and its `3-bis` clause of 2026-10-16; `kernel-surface.md §2.1` item 1's third step).
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  //
+  // **WHAT THIS STEP OWES, IN THE RULING'S OWN TERMS: after channels (i) and (ii) are passed and the pair
+  // stands in the registry, the kernel EVALUATES THAT ONE CONSTRAINT AGAINST THE STORE'S CURRENT STATE,
+  // ONCE, BEFORE THE HANDLE IS RETURNED.** The scope is THAT ONE PAIR and no other: no pass is opened over
+  // the registry and no other registered pair is re-evaluated.
+  //
+  // **⟶ THE THREE STATES, EACH ANSWERED HERE AND AT NO OTHER SITE:**
+  //   (i)   the state PASSES → the call returns the handle exactly as before, and nothing else happened;
+  //   (ii)  it VIOLATES and NO repair is registered → the registration is REFUSED;
+  //   (iii) it VIOLATES and a repair IS registered → THE REPAIR IS ATTEMPTED on the synthetic attempt
+  //         `3-bis` (a) declares, and its outcome answers the call as (i) or as (ii).
+  //
+  // **AND WHAT THE KERNEL HANDS THE SURFACE IS A CODE AND ITS SLOTS, NEVER A SENTENCE.** This module owns
+  // no message generator, and `kernel-surface.md §1` item 2 closes its surface at the FIVE `K-1`…`K-5`
+  // items with no sixth name — so it imports none, is handed none, and declares no channel to one. The
+  // refusal it throws carries `status` (the STORE's member, `A120` (2)) and the `§8.2` row's own slot
+  // VALUES, and the surface renders the text through the generator it already holds. **NO `KC` TOKEN IS
+  // MINTED:** the synthetic attempt's own terminal token stays inside this module (`registrationRefusal`).
+  const refused = registrationEvaluation(kernel, store, address, id, constraint);
+  if (refused !== null) {
+    // **A REFUSED REGISTRATION LEAVES THE REGISTRY EXACTLY AS IT STOOD** (`§2.1` item 1's sentence, whose
+    // regulatory force reaches this third refusing act — `§7.3` (b) state 2's own reading of it): the pair
+    // row this call wrote is withdrawn, with its handle and its place in the address's order list.
+    withdrawRegistration(kernel, address, id, standing === undefined, home);
+    throw refused;
+  }
+  return home;
+}
+
+/**
+ * **WITHDRAWING THE REGISTRY ROW A REFUSED REGISTRATION WROTE** — `kernel-surface.md §2.1` item 1: *"a
+ * refused registration leaves the registry exactly as it stood"*, read at `docs/specs/storeroom-native/
+ * contract.md §7.3` (b) state 2 by that item's own clause (*"the sentence's `2` counts `KC` CHANNELS and
+ * the registration-time refusal is a THIRD REFUSING ACT carrying no `KC` token, so the sentence's FIGURE IS
+ * UNMOVED while its regulatory force (no entry on a refusal) reaches this third act"*).
+ *
+ * **WHAT IT UNDOES IS THIS CALL'S OWN WRITE AND NOTHING ELSE**, which is why the prior-standing fact is
+ * passed in: on the FRESH arm the pair row, its handle and its address-list entry all go; on the
+ * REPLACEMENT arm (a second `register` under a pair that already stood) the row's own POSITION and handle
+ * are left exactly as they were — the pair's idempotence rule (`CC-7`) puts the replaced registration's
+ * position back by never moving it.
+ */
+function withdrawRegistration(kernel, address, id, fresh, home) {
+  if (!fresh) return;
+  const key = pairKey(address, id);
+  kernel.pairs.delete(key);
+  kernel.handles.delete(key);
+  const token = addressToken(address);
+  const list = kernel.byAddress.get(token);
+  if (list !== undefined) {
+    const at = list.indexOf(key);
+    if (at >= 0) list.splice(at, 1);
+    if (list.length === 0) kernel.byAddress.delete(token);
+  }
+  // THE ADDRESS'S HOME ENTRY STANDS: it was minted by the store's own `listen`, which this act has already
+  // performed, and no clause of this unit declares a kernel-side withdrawal of it (`§2.1` item 1: *"nothing
+  // withdraws a constraint's store registration"* — `unlisten` is the app's own verb and never this one's).
   return home;
 }
 
+/**
+ * **THE REGISTRATION-TIME EVALUATION, AT ITS ONE SITE** (`docs/specs/storeroom-native/contract.md §7.3`
+ * (b) and its `3-bis` clause of 2026-10-16; `kernel-surface.md §2.1` item 1's third step and `§2.3` item
+ * 1's clause of 2026-10-17). It answers `null` on state 1 and on state 3's passing arm, and **the refusal
+ * to throw** on state 2 and on state 3's failing one.
+ *
+ * **THE EVALUATION'S CONTEXT IS `§2.3` ITEM 1'S CLAUSE OF 2026-10-17, MEMBER FOR MEMBER, AND IT IS THE
+ * SAME FIVE MEMBERS AS AT A LANDING** — `address` the pair's own; `tier` ABSENT, spelled `null`; `value`
+ * THE STORE'S CURRENT VALUE AT THE PAIR'S ADDRESS, READ AND NOT LANDED; `attempt` the synthetic attempt's
+ * `AttemptRef` on state 3 and `null` on states 1/2; `op` ABSENT, spelled `null`. **A SIXTH MEMBER IS
+ * REFUSED BY NAME** (`5 + 1 = 6` is refused at that item's (6)), and both `null`s are THAT CLAUSE's own
+ * spellings of an absence inside a closed record, taken from the `RollbackStep.checkpoint` precedent, and
+ * are not tokens minted here.
+ *
+ * **THE `value` IS OBTAINED BY THE STORE'S OWN `read` AT THE PAIR'S ADDRESS WITH THE TIER ARGUMENT
+ * OMITTED** — the zero-tier call — **and where that read REFUSES `AddressNotFound` the member carries
+ * `undefined`**, which is that clause's (3) (e) arm. **NO `null` IS MINTED FOR IT** (`DD-12` forbids a
+ * READ answering one) and no `AddressNotFound` code is put in a `Value` slot: the fresh-pair outcome is
+ * the CALLER'S OWN BODY's answer to absence, and no clause decides which a given body is.
+ *
+ * **⟶ AND THE BODY'S OWN THROW IS NOT CONVERTED HERE.** A throw out of the constraint body at this instant
+ * SURFACES AS ITSELF (`fail-surface.md §1.1` item 5, at `kernel-surface.md §2.3` item 1's clause of
+ * 2026-10-17): not re-shaped into this module's form, not wrapped, and carrying no `KC` token. So the
+ * invocation below is NOT wrapped — a throwing body reaches the caller as the very value it threw.
+ */
+function registrationEvaluation(kernel, store, address, id, constraint) {
+  const outcome = constraint(registrationContext(store, address, null));
+  // THE OUTCOME IS `PAR-C-5`'S CLOSED THREE-ARM SET, read as the landing pass reads it: `true` is the pass
+  // arm; an object carrying `message` is the violation arm (its `repair`, where present, the repair the
+  // caller registered); a value outside the three arms is READ AS the `{message}` arm (`VA-11`) and never as
+  // an arm of its own. **A REPAIR THE OUTCOME DOES NOT CARRY IS NO REPAIR REGISTERED FOR THE PAIR.**
+  if (outcome === true) return null;
+  const repair = outcome !== null && typeof outcome === 'object' && 'message' in outcome
+    && 'repair' in outcome && typeof outcome.repair === 'function'
+    ? outcome.repair
+    : null;
+  // STATE 2 — THE STATE VIOLATES IT AND NO REPAIR IS REGISTERED. Nothing is attempted and no attempt is
+  // opened; the refusal carries the store's code and the row's own slots.
+  if (repair === null) return registrationRefusal(address, id, []);
+  // STATE 3 — THE REPAIR IS ATTEMPTED, on the synthetic attempt `3-bis` (a) declares.
+  return registrationAttempt(kernel, store, { address, id, repair });
+}
+
+/// **THE FIVE-MEMBER EVALUATION CONTEXT** (`kernel-surface.md §2.3` item 1's clause of 2026-10-17), built
+/// at ONE site so states 1, 2 and 3 hand the caller's body the SAME record and only `attempt` moves:
+/// `null` on states 1 and 2, the synthetic attempt's `AttemptRef` on state 3.
+function registrationContext(store, address, attemptRef) {
+  return {
+    address: address.slice(),
+    // `tier` — ABSENT, and `op` — ABSENT: the two members carrying the landing's own absence, spelled
+    // `null` on that clause's (2) and (5).
+    tier: null,
+    // `value` — READ, not landed, and `undefined` at an address holding nothing (that clause's (3) (e)).
+    value: readCurrent(store, address),
+    attempt: attemptRef,
+    op: null,
+  };
+}
+
+/// The store's current value at an address, read NOT landed: the zero-tier call whose tier argument is
+/// OMITTED, and `undefined` where that read refuses.
+function readCurrent(store, address) {
+  try {
+    return store.read(address);
+  } catch (refused) {
+    return undefined;
+  }
+}
+
+/**
+ * **THE SIX-MEMBER `RepairContext` THE REPAIR IS HANDED AT REGISTRATION** (`kernel-surface.md §2.3` item
+ * 2's shape, its sixth member `pending: Handle[]` added 2026-10-15; `surface.md §2.11` clause 6, the one
+ * home of the architect's ruling that a repair *"IS PASSED THE COMMIT IT IS PART OF"*).
+ *
+ * **THE REPAIR'S CONTEXT IS NOT THE CONSTRAINT'S CONTEXT, AND THE TWO ARE NOT INTERCHANGEABLE**: the
+ * constraint receives the FIVE-member `AttemptContext` and the repair the SIX-member `RepairContext`, whose
+ * extra member is the commit's own `pending` — *"so that they can make their own write call use that
+ * commit"*. **THE SYNTHETIC ATTEMPT'S OWN `commit` MEMBER IS WHAT THIS SLOT CARRIES** (`3-bis` (a): *"the
+ * `CommitRecord` of the registration act"*), handed as a FRESH LIST the way the landing instant hands it, so
+ * the record's member is never aliased and a repair that mutated its context's list moves nothing on the
+ * commit.
+ *
+ * **AND THE ABSENCE AT THIS INSTANT IS SPELLED BY THE `AttemptContext`'S OWN CLAUSE, NOT MINTED HERE:** there
+ * is no landing, so `op` is `null` (that clause's (5)) and `tier` is `null` (its (2)) — the two absences the
+ * `RollbackStep.checkpoint` precedent already fixes — while `value` is the store's CURRENT value at the
+ * pair's address, read and not landed (its (3)). **`id` IS THE PAIR'S OWN**, which the constraint's context
+ * does not carry at all, the repair's shape declaring it.
+ */
+function registrationRepairContext(store, address, id, commitRecord) {
+  return {
+    address: address.slice(),
+    id,
+    // `tier` — ABSENT, spelled `null`; `value` — READ, not landed; `op` — ABSENT, spelled `null`.
+    tier: null,
+    value: readCurrent(store, address),
+    op: null,
+    // THE COMMIT THE REPAIR IS PART OF — a FRESH LIST, never the record's own member (`§2.3` item 2).
+    pending: Array.isArray(commitRecord.pending) ? commitRecord.pending.slice() : [],
+  };
+}
+
+/**
+ * **STATE 3 — THE SYNTHETIC ATTEMPT AND THE REPAIR IT CARRIES** (`docs/specs/storeroom-native/contract.md
+ * §7.3` (b) `3-bis` (a)–(f); `attempt-lifecycle.md §2.4` items 1, 3, 4 arm (b)).
+ *
+ * **THE ATTEMPT'S RECORD IS ITEM 1's NINE MEMBERS UNCHANGED — NO TENTH MEMBER IS MINTED AND NO MEMBER'S
+ * DOMAIN MOVES:** `ref`, `commit`, `ops`, `log`, `ran`, `appliedRepairs`, `open`, `rollback`, `checkpoint`.
+ * **ITS `address` IS THE PAIR'S OWN**, **`ITS `checkpoint` BEGINS `null`*** — that member's declared `null`
+ * arm, because no landing at that address has yet left it valid for THIS attempt — and **its `ref` is a
+ * kernel-minted `AttemptRef` unique within the instance**. **Its `log` is a real `LogEntry[]` carrying this
+ * kernel's own `seq` ordinal**, and the `constraint-check` and `repair-run` entries arm (b) appends stand in
+ * it. **IT IS TERMINAL-AWARE ON BOTH ARMS**: it reaches `PASSED` or `FAILING` and closes, and no
+ * registration leaves an open attempt in the registry.
+ *
+ * **THE OP THE REPAIR LANDS IS HELD BY THIS ATTEMPT AND NOTHING ELSE** — `3-bis` (a)'s selection of the
+ * synthetic branch, so principle (1) (*"a repair's op is an attempt's op"*) still binds and no op is
+ * admitted outside one.
+ *
+ * **AND ITS OP LANDS DURABLY** (`3-bis` (f)): the repair's edit goes through the store's OWN verbs, its
+ * `op` is a real `JournalOp` in the store's own journal, readable back through every read verb at that
+ * address, and it stands after the registration returns. **THIS IS NOT A DRY RUN**, and no clause of that
+ * contract may be read as one. **ON SUCCESS NO LOG CROSSES** (`3-bis` (c), under `A135` (1)'s
+ * failure-only bubbling): the caller receives the identity ALONE, and the repair's outcome is carried by
+ * this attempt's own `log` and `ops` — the two carriers that clause fixes.
+ *
+ * **ON FAILURE THE REGISTRATION IS REFUSED** (`3-bis` (d)'s arms (d)/(e)/(f)): the store's
+ * `ConstraintListInvalid` is answered in the SAME form and with the SAME THREE SLOTS as state 2's. The
+ * synthetic attempt's `KC-4`/`KC-5`/`KC-6` **stays inside this module** and reaches no caller, because the
+ * caller's act is the registration and it is the registration that is refused (`§7.3` (e)'s re-reading).
+ */
+function registrationAttempt(kernel, store, pair) {
+  const address = pair.address;
+  const key = pairKey(address, pair.id);
+  ATTEMPTS += 1;
+  const attempt = {
+    ref: { id: `attempt-${ATTEMPTS}` },
+    store,
+    address: address.slice(),
+    tier: null,
+    value: undefined,
+    // `commit` — THE REGISTRATION ACT'S OWN `CommitRecord` (`3-bis` (a)): this kernel's four members, with
+    // no write's op and no write's triggered set, because a registration lands no `K-2` of its own.
+    commit: { attempt: null, op: null, triggered: [], pending: [] },
+    write: null,
+    ops: [],
+    log: [],
+    ran: [],
+    appliedRepairs: [],
+    rollback: [],
+    checkpoint: null,
+    checkedOff: [],
+    status: 'open',
+    report: null,
+  };
+
+  // ARM (b) VERBATIM: the `constraint-check` entry and the `repair-run` entry are appended, the repair runs
+  // through the caller's own verb, and the op its `{ok: true, op}` return names is added to `ops` while its
+  // pair is appended to BOTH `ran` and `appliedRepairs` (`3-bis` (b): the pair JOINS both members — of the
+  // SYNTHETIC attempt, and of no other). **THE PAIR ENTERS `ran` BEFORE THE REPAIR RUNS**, which is that
+  // arm's own ordering and is what makes the repeat arms reachable at the re-run below.
+  append(attempt, 'constraint-check', pair.id, null, `the evaluation of ${pair.id}`);
+  attempt.ran.push(key);
+  append(attempt, 'repair-run', pair.id, null, 'the pair\'s repair was attempted at registration');
+
+  let result;
+  try {
+    result = pair.repair(registrationRepairContext(store, address, pair.id, attempt.commit));
+  } catch (body) {
+    // A REPAIR WHOSE BODY THROWS IS A FAILED REPAIR AND THE REGISTRATION IS REFUSED — the caller's act is
+    // the registration, so the refusal is this module's one form (`3-bis` (d); the `KC` boundary at (e)).
+    // **THE BODY'S THROWABLE IS NOT CONVERTED INTO A STORE FORM AND IS NOT REACHED BY THE CALLER HERE**: it
+    // is caught so the attempt can close and the registration can be refused in the declared form; a drive
+    // that expected the body's own value out of `addConstraint` has read a route no clause declares.
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+
+  const ok = result !== null && typeof result === 'object' && result.ok === true;
+  const produced = ok ? landedOp(attempt, result, null) : null;
+  if (produced === null) {
+    // ARM (d) — THE REPAIR PRODUCED NO OP: `{ok: false, message}`, an outside-form return, or an
+    // `ok === true` return whose `op` is absent, `undefined` or not the one it landed.
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+
+  attempt.ops.push(produced);
+  attempt.appliedRepairs.push(key);
+  const entry = attempt.log[attempt.log.length - 1];
+  entry.opId = produced.opId;
+  entry.message = `the repair ${pair.id} landed ${produced.opId}`;
+
+  // THE RE-RUN — `3-bis` (d)'s arms (e)/(f) and `3-bis` (e)'s ordinary landing rules: the repair's op
+  // LANDED, so the pairs registered at ITS OWN landing's address are evaluated by the ordinary pass
+  // (`kernel-surface.md §2.3` item 1), in first-registration order, against THAT op.
+  const failed = registrationRerun(kernel, attempt, produced);
+  if (failed !== null) {
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+  // THE PASSING ARM: `PASSED` → `CLOSED` and the registration STANDS. **NO LOG CROSSES**, and the repair's
+  // edit STANDS in the store — the side effect the architect's trust clause licenses (`3-bis` (f)).
+  closeRegistrationAttempt(attempt, 'passed');
+  return null;
+}
+
+/// **THE SYNTHETIC ATTEMPT'S RE-RUN** — every pair standing at the attempt's own address, evaluated once
+/// against the repair's own op (`attempt-lifecycle.md §2.4` item 5 (iv)'s evaluated set, which the
+/// registration instant neither widens nor displaces). Answers `null` where the re-run passes and the arm's
+/// token where it does not.
+///
+/// **THE ARM IS READ OFF THE PAIR THAT FAILED AND OFF NOTHING ELSE** (item 4's disjointness rule): the
+/// pair under repair is IN `ran` — arm (b) wrote it — and arm (b) has just put it in `appliedRepairs`, so a
+/// repeat by the repair's OWN edit reaches `(e)`; a pair IN `ran` and NOT in `appliedRepairs` reaches
+/// `(f)`. **`(c)` is unreachable here**, the pair's own function having already run at this instant.
+function registrationRerun(kernel, attempt, produced) {
+  const list = kernel.byAddress.get(addressToken(attempt.address));
+  if (list === undefined) return null;
+  for (const key of list.slice()) {
+    const pair = kernel.pairs.get(key);
+    if (pair === undefined) continue;
+    const outcome = pair.constraint({
+      address: attempt.address.slice(),
+      tier: produced.tier === undefined ? null : produced.tier,
+      value: produced.after === undefined ? undefined : produced.after.value,
+      attempt: attempt.ref,
+      op: produced,
+    });
+    if (outcome === true) continue;
+    attempt.terminalArm = attempt.appliedRepairs.includes(key) ? 'KC-5' : 'KC-6';
+    return attempt.terminalArm;
+  }
+  return null;
+}
+
+/**
+ * **THE REFUSAL THE REGISTRATION ANSWERS — `ConstraintListInvalid` WITH ITS `§8.2`-GENERATED MESSAGE —
+ * COMPOSED HERE AS A CODE AND ITS SLOTS, AND RENDERED BY THE SURFACE.**
+ *
+ * **⟶ THIS IS THE ROUTE THE ARCHITECT SETTLED, AND IT IS NOT A MESSAGE FROM A SECOND SOURCE.** `DD-52`
+ * forbids a code's message being produced from a second source, and `§8.2`'s one row declares the slots
+ * this instant supplies: **`<CONTAINER>` the pair's own list name, `constraints`**; and **`<SEGMENT>` the
+ * ADDED PAIR's `address` spelling, joined by `/`** — the pair's OWN address and not a failing element's,
+ * because at this instant the entry is WELL-FORMED and the pair is SUBMITTED rather than found wrong.
+ * (`<KEYLIST>`, the row's third slot, is the added pair's members present; no slot of it is asserted here,
+ * `§8.2` clause 3 declaring that the sentence the slots make is asserted by NO clause of that contract.)
+ *
+ * **THE FIXED PHRASE *"is not a valid constraint entry in"* IS RENDERED VERBATIM AND IS NOT RE-AUTHORED** —
+ * `§8.2`'s clause 3 of 2026-10-16, which names the honest consequence: at this instant the sentence's SHAPE
+ * reports an entry that failed its own validity check while the state is a well-formed pair whose FUNCTION
+ * DID NOT PASS. **A HAND-AUTHORED REGISTRATION MESSAGE IS A FAIL OF `P-TP-9` AND NONE STANDS HERE**: not a
+ * byte of the text is written in this module, and the sentence is produced by the store's own generator at
+ * the surface's existing `errorMessage` path.
+ *
+ * **THE VALUE CARRIES THIS MODULE'S OWN MARK** (`KERNEL_REFUSAL`) so the surface can tell it from a
+ * caller's throw, and the mark is set HERE — in the frame that BUILT the value — and never by a test over
+ * members. **A CALLER'S OWN THROWN VALUE STILL SURFACES AS ITSELF**: the 2026-10-17 forgery fix's whole
+ * point, and the five shapes are re-probed with this arm in place.
+ */
+function registrationRefusal(address, id, log) {
+  return {
+    status: 'ConstraintListInvalid',
+    segment: address.map((segment) => String(segment)).join('/'),
+    container: 'constraints',
+    id,
+    log: Array.isArray(log) ? log : [],
+    [KERNEL_REFUSAL]: true,
+  };
+}
+
+/// **THE SYNTHETIC ATTEMPT'S TERMINAL ACT — `PASSED` OR `FAILING`, AND `CLOSED` FROM THOSE TWO AND FROM
+/// NOWHERE ELSE** (`attempt-lifecycle.md §2.4` item 3). It reaches neither the per-op rollback composition
+/// nor the delivery seam: **the registration instant opens no `K-2`, delivers no listener and composes no
+/// rollback** — the repair's edit STANDS on the passing arm (`3-bis` (f)), and a failed repair's own state
+/// is left where the store's own verb left it (`3-bis` (d): the store's state is left where the composition
+/// restored it, which for an attempt with no rollback composed is the state the verb produced).
+function closeRegistrationAttempt(attempt, outcome = 'failed') {
+  attempt.status = 'closed';
+  const report = {
+    attempt: attempt.ref,
+    outcome,
+    ops: attempt.ops.slice(),
+    log: attempt.log,
+    rollback: [],
+  };
+  attempt.report = report;
+  CLOSED.set(attempt.ref.id, report);
+  LIVE.delete(attempt.ref.id);
+  return report;
+}
+
+
 /** The store holds ONE registration per address, and its `listen` takes a function. */
 function noopListener() {}
 
@@ -908,10 +1282,24 @@ function evaluate(kernel, attempt, landing) {
         // (the store's form is `{status, message}`, carrying no `log` member — `§1.2` item 2; the
         // kernel's own form carries three members, and a `KC` token is never named as a store code).
         // The entry's `state` stays `null`; the thrown form's `status` is `KC-4`.
+        // **⟶ THE TEST THAT THIS THROWABLE IS *NOT* THE KERNEL'S OWN WAS `!('log' in body)`, AND THAT
+        // TEST DIED ON 2026-10-16 WITH THE FLAT `log` RULING — THIS IS THE SECOND SITE THE RULING BROKE AND
+        // IS REPORTED AS A FINDING, NOT SILENTLY REPAIRED.** The old test read *"the store's form carries two
+        // members and the kernel's carries three, so a `log` member means the kernel built it"*. **`surface.md
+        // §2.5` item 4 now puts `log` on EVERY failure the JS surface throws, so a STORE REFUSAL REACHING
+        // THIS FRAME THROUGH THE PACKAGE CARRIES A `log` AND THE OLD TEST READ IT AS THE KERNEL'S OWN** —
+        // measured: the two `S-JOIN` `WriteParentNotLink` cells went red with the caller's `status` reading
+        // `WriteParentNotLink` instead of `KC-4`, because `storeCode` was answered `null` and the refusal fell
+        // through to the unconverted `throw body` below.
+        //
+        // **THE REPLACEMENT IS THE SAME ONE THE ENTRY'S CROSSING TOOK — THE KERNEL'S OWN REFUSAL-CLASS MARK
+        // AND NEVER A MEMBER'S PRESENCE** (`KERNEL_REFUSAL` above): a value this kernel built is marked, and
+        // everything unmarked that carries a store code IS a store code, whatever members the surface has
+        // attached to it on its way back. A `KC` token is still never a store code on either spelling.
         const storeCode = body !== null && typeof body === 'object'
+          && isKernelRefusal(body) === false
           && typeof body.status === 'string'
           && body.status.length > 0
-          && !('log' in body)
           && !KC_TOKENS.includes(body.status)
           ? body.status
           : null;