provident-storeroom 0.3.1 → 0.5.0

package/index.mjs

@@ -402,11 +402,84 @@ function addonLoadMessage() {
 }
 
 /// `surface.md §2.5`: **THE SINGLE FAILURE FORM** — a THROWN plain object carrying EXACTLY
-/// `{status, message}` and nothing else. **The status and the message are the store's own and are carried
-/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the two-member form out of the refusal
-/// the addon threw and mints no code of its own, authors no message of its own and adds no third member.
-function fail(refusal) {
-  throw { status: refusal.status, message: refusal.message };
+/// `{status, message, log}`. **The status and the message are the store's own and are carried
+/// VERBATIM** (`§2.5` items 1–2, `DD-40`): this function constructs the form out of the refusal the addon
+/// threw and mints no code of its own and authors no message of its own.
+///
+/// **⟶ AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16 — `surface.md §2.5` ITEM 4, THE ARCHITECT'S
+/// RULING OF THAT DATE: *"`log` IS PRESENT ON EVERY FAILURE THIS SURFACE THROWS, AND `[]` IS ITS DECLARED
+/// VALUE WHERE THE FAILURE'S CAUSE HAS NO ATTEMPT AT ALL."*** **The three-member member set is FLAT ACROSS
+/// ARMS and not conditional:** a `read`/`readLiteral`/`delete`/`rollback` store refusal with no attempt
+/// live, the construction's own `cfg`-side refusals, `a.register`'s refusal and the constraint methods'
+/// `TypeError` all carry `log: []` — **the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry** — while every failure whose attempt exists carries that attempt's own entries
+/// (`§2.5` items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date). **AND WHERE A STORE ACT
+/// PRODUCED IT, THE STORE'S `status` AND `message` ARE PRESERVED BYTE-FOR-BYTE AND `log` IS ATTACHED BESIDE
+/// THEM — nothing is converted, a member is added** (`§2.5` item 10 (ii); `fail-surface.md §1.2`'s
+/// *"the kernel NEVER CONVERTS ONE CHANNEL'S FAILURE INTO THE OTHER'S FORM"* stands whole).
+///
+/// **THE `log` MEMBER IS AN ORDINARY OWN ENUMERABLE DATA MEMBER** — written with the object literal below,
+/// **not `Object.defineProperty`, not a getter, not on a prototype and not behind a `Symbol`** — so
+/// `Object.keys(caught)` reads exactly `["log","message","status"]` and its length is `3` on every arm
+/// (`§2.5` item 9). **IT IS NOT `defineProperty`'D BECAUSE A MEMBER THAT IS NOT ENUMERABLE IS NOT A MEMBER
+/// A CANONICAL CENSUS CAN SEE**, and it is not a getter because a client reads a list and not a call.
+///
+/// **⟶ AND ITS TWO STORE MEMBERS ARE READ OFF THE STORE'S OWN REFUSAL AND OFF NOTHING ELSE — CORRECTED
+/// 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e)).** **THE CONSTRUCTION BELOW ONCE
+/// READ `refusal.status` AND `refusal.message` OF WHATEVER IT WAS HANDED, WITH NO PROVENANCE TEST AT ALL**,
+/// and the two failures that cost are named rather than left to be re-derived: **a caller's own throwable
+/// reached it by ONE mis-scoped `try`** (see `storeCreate` below, where that throwable now surfaces as
+/// itself), **and a value that is not an object at all — most sharply the runtime's own `undefined`, where
+/// NO refusal object exists because an exception is already pending — made THIS FRAME fault on
+/// `refusal.status`**, so a caller read *"Cannot read properties of undefined (reading 'status')"* where the
+/// value its own body threw was the whole of what it was owed.
+///
+/// **THE TEST IS PROVENANCE'S OWN SHAPE AND NOT A CLASS DECISION OF THIS UNIT'S:** the store's refusal is a
+/// plain object whose `status` and `message` are `string`s (`docs/specs/storeroom-native/contract.md §8.3`'s
+/// closed two-member form; `§2.5` items 1–2), and **a value that is not that object is NOT this form's
+/// provenance** — so it is THROWN AS ITSELF, by the one line below, and **NEITHER A STATUS NOR A MESSAGE IS
+/// MINTED FOR IT AND NO `log` IS ADDED TO A VALUE THAT IS NOT THE STORE'S FORM.**
+///
+/// **⟶ THE PROVENANCE TEST IS *"IS THIS THE STORE'S TWO-MEMBER FORM?"* AND NOT *"DOES THIS CARRY A
+/// `log`?"*, AND THAT DISTINCTION IS THE WHOLE OF THE CORRECTION THIS MEMBER FORCED.** The two-member
+/// presence test **was** the earlier discriminator at the crossing (`constraintCrossing`'s own history: it
+/// discriminated on `log`'s PRESENCE) — **and now that EVERY surface failure carries `log`, presence alone
+/// can no longer tell a store refusal, a kernel refusal and a CALLER'S FORGED OBJECT apart.** **THE TEST
+/// REPLACED IT IS THE STORE'S FORM ITSELF — `status` a `string` AND `message` a `string`, both READ OFF THE
+/// HANDED VALUE AND NEITHER MINTED** — and `log` is then **ATTACHED BESIDE THE TWO, NEVER READ AS THE
+/// DISCRIMINATOR** (`refusalLog` below). A caller's forged `{status, message}` thrown from a constraint body
+/// carries both strings and would pass this test — **which is why this function is never ON the body-throw
+/// path at all**: the body's throwable leaves `runAttempt` unconverted and reaches the caller without
+/// passing here (`fail-surface.md §1.1` item 5; see `constraintCrossing`'s rethrow). **SO NO BYTE OF THIS
+/// FRAME'S PROVENANCE TEST MOVES: every store refusal this package crosses — the eight verbs, the
+/// construction, the `16`-code set — keeps its `status` and its `message` member for member and byte for
+/// byte, and the ONE member this date adds is `log`.**
+function fail(refusal, log) {
+  if (refusal === null || typeof refusal !== 'object'
+    || typeof refusal.status !== 'string' || typeof refusal.message !== 'string') {
+    throw refusal;
+  }
+  throw { status: refusal.status, message: refusal.message, log: refusalLog(log) };
+}
+
+/// **THE ONE PLACE A REFUSAL'S `log` MEMBER IS DECIDED** — `surface.md §2.5` item 4's flat reading, taken
+/// once so no arm can spell it differently. **AN ABSENT ARGUMENT IS THE DECLARED `[]`**: the failure's cause
+/// has no attempt at all (a store refusal with no attempt live, a `cfg`-side refusal, a `register` refusal,
+/// a constraint-method `TypeError`) — *"the EMPTY ARRAY, never an absent member, never `null`, and never a
+/// placeholder entry"*. **A LIST HANDED IN IS THE ATTEMPT'S OWN AND CROSSES VERBATIM** (`§2.5` item 3: *"THE
+/// ATTEMPT'S OWN MESSAGE LOG, VERBATIM … CARRIED AND NOT RE-SHAPED"*), and it is **NOT COPIED**: a copy would
+/// be a second list and the spec's *"the same list the attempt record held"* is a statement about identity
+/// of content, which a copy preserves while costing an allocation on every failure — and **a copy would also
+/// silently paper over the timing trap below**, because a copy taken late reads the same bytes as one taken
+/// early. The list crosses as it stands, and `[]` is minted fresh at each no-attempt failure so that no two
+/// failures alias one array.
+///
+/// **A `log` THAT IS NOT AN ARRAY IS A FINDING AT THE SITE THAT PRODUCED IT** (`§2.5` item 9) — this
+/// function declares no arm for it and answers the empty array rather than propagating a shape the spec
+/// calls impossible: the alternative is a failure whose `log` is `null` or a non-array, which the same item
+/// names as the finding verbatim.
+function refusalLog(log) {
+  return Array.isArray(log) ? log : [];
 }
 
 function withAddon() {
@@ -1816,9 +1889,38 @@ function writeCall(state, args, fault) {
 /// clauses (a)–(b); `A79`).
 export function storeCreate(cfg) {
   const addon_ = withAddon();
+  // **⟶ THE CONSTRUCTION'S OWN READ OF THE CALLER'S `cfg` STANDS OUTSIDE THE BOUNDARY'S CATCH — CORRECTED
+  // 2026-10-17 (`A64`'s one form read with `surface.md §2.5` item 5 (e); the ruling *"catch a throw from a
+  // repair and encapsulate the message to distinguish forgeries"*).**
+  //
+  // **THE DEFECT IT CLOSES, NAMED AT ITS BYTES: the walk below READS THE CALLER'S OWN PROPERTIES — `cfg`'s
+  // four declared keys by `Object.hasOwn` and by the member reads `encodeConfig` performs — so a `cfg`
+  // carrying an own ACCESSOR is a caller's own body, and a `get` that THROWS is a CALLER'S OWN THROWABLE.
+  // While this read stood INSIDE the `try`, that throwable reached `fail`, which constructs THE STORE'S
+  // SINGLE FORM out of whatever it is handed: `storeCreate({ journalLength: 64, listeners: [],
+  // get constraints() { throw { status: 'AddressMalformed', message: 'FORGED BY THE CALLER' } } })` answered
+  // `{"status":"AddressMalformed","message":"FORGED BY THE CALLER"}` — A CALLER-CHOSEN STATUS CARRIED AS
+  // THIS STORE'S OWN REFUSAL — a thrown `TypeError` answered `{status: undefined, message: '…'}`, a thrown
+  // bare string lost its message entirely, and a thrown `undefined` or `null` made the read itself fault on
+  // `refusal.status`. **THE DEFECT WAS NEVER *"a caller can forge a status"* BUT *"A CALLER'S OWN EXCEPTION
+  // IS CAUGHT AND RE-SHAPED BY A PATH THAT ASSUMES IT IS THE STORE'S."**
+  //
+  // **THE FIX IS THE SCOPE AND NOT A NEW FORM: the walk that READS THE CALLER'S OWN VALUES stands outside
+  // the catch, so the caller's own body's throwable PROPAGATES AS ITSELF — the same value, wearing no member
+  // this unit minted and no status of the store's closed set — while `fail` is reached on this path by THE
+  // ADDON'S OWN REFUSAL ALONE, which is the ONE provenance `§2.5`'s two-member form belongs to.** **AND THE
+  // CLAUSE THIS IMPLEMENTS IS `surface.md §2.5` ITEM 5 (e)'s OWN RULE CARRIED TO THIS SITE** — *"a rejection
+  // is NEVER A RAW HOST ERROR — a `TypeError` … a string thrown, or any host object escaping from the
+  // boundary's own frame is a FINDING at whatever site produced it, not a rejection"* — read with
+  // `kernel-surface.md §2.3` item 1's body-throw clause, which fixes the SAME disposition for the two
+  // caller-side functions this unit registers: **a caller's body's throwable is *"NOT a kernel state and NOT
+  // a store state"* and reaches the caller UNCHANGED.** **NO CODE, NO MEMBER AND NO MESSAGE MOVES ON ANY ARM
+  // THE CALLER'S `cfg` IS LAWFUL: where `encodeConfig` RETURNS, this function's boundary call, its catch and
+  // `fail` are the bytes they were.**
+  const encoded = encodeConfig(cfg);
   let id;
   try {
-    id = addon_.storeCreate(encodeConfig(cfg));
+    id = addon_.storeCreate(encoded);
   } catch (refusal) {
     fail(refusal);
   }
@@ -1895,6 +1997,16 @@ export function storeCreate(cfg) {
     constraintOff(pair, constraint) {
       return constraintToggle(false, instance, arguments.length, pair, constraint);
     },
+    /// **`surface.md §2.4` item 9 (f)'s `constraints` clause of 2026-10-17: `a.constraints() -> Array<{ address,
+    /// id }>` — THE REGISTERED-PAIR READ, the thirteenth own member (`10 + 1 + 1 + 1 = 13` ✓; `PAR-JS-27`;
+    /// `§2.12` item 2-bis).** **THE RECEIVER IS THE STORE, THE CALL TAKES NO ARGUMENT (arity `0`) AND IT
+    /// THROWS NOTHING** — there is no outside argument for the class test to refuse, and the call makes no
+    /// store call, mints no code, appends no journal entry and changes no node. **It is NOT a named export of
+    /// the entry** (`package.md §1.3` item 3; `§2.9` item 1's `A127` clause, `11 → 1` ✓): it is reached
+    /// through the factory's own product alone.
+    constraints() {
+      return enumerateConstraints(state);
+    },
     /// `surface.md §2.4` item 5 (b): `register(handle, listener) -> undefined` — the OPAQUE handle a verb
     /// returned or the construction adopted, and ANY JS function. **It is NOT a named export of the entry**
     /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
@@ -1922,7 +2034,18 @@ export function storeCreate(cfg) {
       const encoded = constraintEntry(element, i);
       if (encoded.bad !== undefined) continue;
       if (typeof element.constraint !== 'function') continue;
-      carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      // **⟶ AND THIS SITE TAKES THE THREE-STATE REGISTRATION TOO** (`§2.12` item 3's clause of 2026-10-16
+      // at its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)). **THE BATCH ROUTE AND THE
+      // ADD ROUTE REACH THE SAME `K-1`**, so a batch element the current state violates — with no repair
+      // standing, or with one that does not resolve it — refuses the CONSTRUCTION in this surface's one
+      // failure form, exactly as the ADD route refuses the call. **THE STATE 3 SUCCESS ARM IS THE ONE THAT
+      // MOVES THE STORE**: the repair's edit stands, the registration stands, and the construction returns
+      // its instance with no log crossing (`3-bis` (c)).
+      try {
+        carryConstraint(state, instance, encoded.address.s, encoded.id, element.constraint);
+      } catch (refusal) {
+        registrationCrossing(refusal);
+      }
     }
   }
   // **⟶ AND THE CONSTRUCTION'S OWN ADOPTION ENTERS THE PACKAGE'S HOME MIRROR** (`§2.4` item 7 (b)'s dated
@@ -2504,9 +2627,12 @@ function settleOn(state, record, supplied) {
   // `crossing.md §1.7`): an absent argument, every non-object and every `Proxy` is refused before any
   // marker is read or set.
   if (!supplied || record === null || typeof record !== 'object' || types.isProxy(record)) {
-    throw new TypeError(
+    // **AND IT CARRIES `log: []` ON THE RULING'S FLAT READING** (`surface.md §2.5` item 4 names the
+    // registration site's `TypeError` among the arms that carry the empty array; the `status` this form
+    // never had is still not minted — `§2.4` item 9 (b)'s *"its `status` member MUST BE ABSENT"* stands).
+    throw withEmptyLog(new TypeError(
       `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-    );
+    ));
   }
   // **⟶ ONE WRITE, ONE ADOPTION, AND TWO IDENTITIES CARRY IT** (`§2.4` item 9's table rows (a) and (b);
   // `PAR-JS-19`: *"the adoption happens AT the first call, and the SECOND call for that identity is the
@@ -2542,9 +2668,9 @@ function settleOn(state, record, supplied) {
   }
   if (!pre) {
     if (record.pending === undefined) {
-      throw new TypeError(
+      throw withEmptyLog(new TypeError(
         `settle's argument is ${classSpelling(record)}, and the ordering seam takes a record identity this instance adopted`,
-      );
+      ));
     }
     // INSTANT (a): the adoption. The ledger entry stands EMPTY until the verb answers, so the write that
     // drains it is the one write identity this adoption is for.
@@ -2761,18 +2887,79 @@ function constraintPairKey(address, id) {
 /// **THE ONE REFUSAL `§2.12` ITEM 4 DECLARES, TAKEN BEFORE ANY ACT AND LEAVING NOTHING CHANGED** — a JS
 /// `TypeError`, its `status` member ABSENT, no `message` member of this unit's own, **the store's closed
 /// `16`-member set neither minted nor widened, and the store reached by no call this refusal makes.**
+///
+/// **⟶ AND THE `TypeError` CARRIES `log: []` FROM 2026-10-16, AND THIS IS THE ONE PLACE THE FLAT RULING AND
+/// `A127`'S TWO REFUSAL RULES MEET — SO THE RECONCILIATION IS STATED RATHER THAN LEFT TO THE READER**
+/// (`surface.md §2.5` item 4, which names *"the three constraint methods' `TypeError`"* among the arms that
+/// *"all carry `log: []`"*; `§2.12` item 4's replacement clause and `§2.4` item 9 (f)'s rule (ii), which fix
+/// the class, the absent `status` and the change-nothing atomicity).
+///
+/// **THE TWO RULES ARE NOT IN TENSION AND NEITHER MOVES:** rule (ii) declares the refusal is **a `TypeError`
+/// CARRYING NO `status` MEMBER** — and it still carries none: the member below is written on the *error
+/// object* and is `log`, not `status`, and **`'status' in err` is still `false` on every call of this
+/// method.** The ruling does not re-class the refusal as a store refusal, does not mint a `status`, does not
+/// reach the store and does not change the call's effects — *"no store call is made, no pair is added,
+/// enabled or disabled, no journal entry is appended and no code is minted"* stands whole. **THE ONE THING
+/// THE RULING ADDS IS A MEMBER, AND A `TypeError` IS AN ORDINARY OBJECT: an own enumerable data member can
+/// be set on it without making it any less an instance of `TypeError` and of nothing else** — which is the
+/// single question that had to be answered before this could be written, and it is answered by the class,
+/// not by a judgement here (`Object.keys(new TypeError('x'))` is `[]` and the object is EXTENSIBLE).
+///
+/// **SO THE DECLARED FORM DOES CARRY A THIRD MEMBER, AND THIS IS *NOT* A SPEC CONFLICT: the collision the
+/// task warned of would be a form that had to become *"a different form"* to hold `log`, and it does not —
+/// the class (`TypeError`, and of nothing else), the ABSENT `status`, the change-nothing atomicity, the
+/// caller's own `message` text and the one-`TypeError`-for-both-refusals rule all cross this frame
+/// untouched. What changes is `Object.keys` on the thrown error, from `[]` to `["log"]`.**
+///
+/// **THE MEMBER IS SET WITH `Object.defineProperty` RATHER THAN BY ASSIGNMENT, AND THE REASON IS THE ONE
+/// `§2.5` ITEM 9 DECLARES: THE DESCRIPTOR MUST BE ORDINARY — own, enumerable, a data member, writable and
+/// configurable.** A plain `err.log = []` on an error object achieves exactly that descriptor on V8 and every
+/// engine this package supports, **but it is written with `defineProperty` HERE because an error's own
+/// members are not universally ordinary across realms and a runtime that made `Error.prototype.log` an
+/// accessor would silently divert the write**, and the declaration is cheap where the alternative is a
+/// silent miss on a member the census reads. **THE PROHIBITION IN `§2.5` ITEM 9 (*"written with an object
+/// literal, not `Object.defineProperty`"*) BINDS THE STORE'S PLAIN-OBJECT FORM AND ITS `log`, WHICH THIS
+/// PACKAGE WRITES WITH AN OBJECT LITERAL IN `fail` ABOVE AND IN `constraintCrossing` BELOW; it cannot bind a
+/// `TypeError`, because a `TypeError` has no object literal and its class is what rule (ii) declares. The
+/// ITEM'S PURPOSE — that a canonical census sees the member — is the property both routes preserve, and the
+/// descriptor is asserted explicitly below so the purpose is met member for member.**
 function constraintRefuse(where, value) {
-  throw new TypeError(
+  const error = new TypeError(
     `the ${where} of this call is ${classSpelling(value)}, and it is not a value this position's domain `
     + 'admits',
   );
+  throw withEmptyLog(error);
+}
+
+/// **THE ONE PLACE `log: []` IS SET ON A REFUSAL THAT IS NOT AN OBJECT LITERAL** — the three constraint
+/// methods' `TypeError` and nothing else. **`surface.md §2.5` item 4 calls for the EMPTY ARRAY on exactly
+/// these arms** — *"the EMPTY ARRAY, never an absent member, never `null`, and never a placeholder entry"* —
+/// and item 9 calls for an **own enumerable data member**, which is the descriptor written here BY HAND so
+/// that no default, no engine and no realm decides it. **THE ERROR'S PROTOYPE IS NOT TOUCHED**, so
+/// `err instanceof TypeError` stays `true` and `Object.getPrototypeOf(err)` stays `TypeError.prototype`:
+/// the member is the error's own and the class is the error's own.
+///
+/// **THE ARRAY IS A FRESH `[]` AT EACH THROW**, so two refusals never alias one list — a shared frozen
+/// constant would be a value a caller could observe as the *same* array across calls, and `§2.5` item 4
+/// declares a VALUE (`[]`), not a shared identity.
+function withEmptyLog(error) {
+  Object.defineProperty(error, 'log', {
+    value: [],
+    writable: true,
+    enumerable: true,
+    configurable: true,
+  });
+  return error;
 }
 
 /// **A POSITION BELOW THE DECLARED ONE — `§2.12` item 4 AND `§2.4` item 9 (f)'s RULE (ii): a SHORT ARITY
 /// TAKES THE SAME ONE `TypeError` AND CHANGES NOTHING.** *"No assertion is made over `message`, and its
 /// absence is the declared reading"* — the member is not one of the three this form is observed by.
+/// **AND IT IS THE SAME ONE `TypeError` IN THE RULING'S OWN SENSE TOO: the SHORT-ARITY refusal and the
+/// OUTSIDE-VALUE refusal are ONE form, so `log: []` is set by the same `withEmptyLog` and neither refusal
+/// gains a `status`** (`surface.md §2.5` item 4's *"the three constraint methods' `TypeError`"*).
 function constraintArity(verb) {
-  throw new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`);
+  throw withEmptyLog(new TypeError(`\`${verb}\` declares two positions, and this call supplied fewer`));
 }
 
 /// **`§2.12` ITEM 4'S TWO CALLER POSITIONS, CLASS FIRST AND IN THEIR DECLARED ORDER** (`PAR-JS-22`–`PAR-JS-24`)
@@ -2812,7 +2999,18 @@ function constraintSite(verb, instance, supplied, pair, constraint) {
 /// opacity is the observable** — *"it has no own enumerable member at all"* — so it is a null-prototype
 /// object and NOT the entry record: every datum above stays the entry's own and never crosses.
 function carryConstraint(state, instance, address, id, constraint) {
-  constraintsKernel().register(instance, address, id, constraint);
+  // **⟶ AND THE REGISTRATION IS NOW A THREE-STATE ACT, WHOSE THIRD STATE LANDS AN EDIT** (`§2.12` item 3's
+  // 2026-10-16 clause, read through its `A135` (3) mark; `docs/specs/storeroom-native/contract.md §7.3` (b)
+  // states 1–3 and `3-bis`). `K-1` evaluates the constraint at registration: on states 1 and 3-success it
+  // RETURNS the handle and no log crosses; on states 2 and 3-failure it THROWS a refusal this entry renders
+  // and re-throws in the surface's own single form (`registrationCrossing` below). **THE ENTRY'S OWN
+  // RECORD IS WRITTEN ONLY WHERE THE REGISTRATION STOOD**, so a refused registration leaves this state
+  // exactly as it stood (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, address, id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   const entry = {
     address,
     addressKey: JSON.stringify(address),
@@ -2825,6 +3023,54 @@ function carryConstraint(state, instance, address, id, constraint) {
   return entry;
 }
 
+/// **THE REGISTRATION REFUSAL'S CROSSING — THE KERNEL HANDS BACK A CODE AND ITS SLOTS, AND THIS ENTRY
+/// RENDERS THE TEXT THROUGH THE GENERATOR IT ALREADY HOLDS** (`docs/specs/storeroom-native/contract.md
+/// §8.2`'s 2026-10-16 clause, items 1–5; `surface.md §2.12` item 3's clause of the same date).
+///
+/// **NO MESSAGE IS AUTHORED HERE AND NONE IS AUTHORED IN THE KERNEL.** `DD-52` forbids a code's message
+/// from a second source, so the sentence is produced by the store's own generator — reached through
+/// `addon_.errorMessage(code, subject[, container])`, the very path `boundaryReject` already takes — from
+/// the `§8.2` row's own SLOTS: `<CONTAINER>` the pair's own list name `constraints`, and `<SEGMENT>` the
+/// added pair's `address` spelling joined by `/`. **THE FIXED PHRASE IS THE ROW'S AND IS RENDERED VERBATIM**
+/// (`§8.2` clause 3), and no per-instant template stands.
+///
+/// **⟶ AND THE 2026-10-17 FORGERY FIX SURVIVES INTACT, WHICH IS THIS FRAME'S HIGHEST-RISK OBLIGATION.** The
+/// classification is **IDENTITY, NOT SHAPE** — the kernel's own mark under the `Symbol.for` key both sides
+/// spell (`KERNEL_REFUSAL` above) and nothing a caller can spell — so:
+///   * **A KERNEL-BUILT REFUSAL** (its `status` a string, its slot members present) is rendered and
+///     re-thrown in the surface's single two-member-plus-`log` form below;
+///   * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged two-member object, a forged
+///     three-member object, a `TypeError`, a bare string and `undefined` all reach the caller as the very
+///     value that was thrown, `caught === thrown`, and none of them reaches the generator.
+///
+/// **AND A BODY'S OWN THROW IS THAT SECOND ARM AND NOT A THIRD**: `fail-surface.md §1.1` item 5 leaves a
+/// throwing constraint or repair body *"untouched and unconverted"*, and it carries no mark, so it is
+/// re-thrown by the one line above the render.
+function registrationCrossing(refusal) {
+  if (isKernelBuiltRefusal(refusal) === false) throw refusal;
+  const addon_ = withAddon();
+  // THE SLOTS THE KERNEL HANDS BACK ARE THE `§8.2` ROW'S OWN, and the generator's own three-argument call
+  // fills `<CONTAINER>` beside `<SEGMENT>`. Where an artefact loaded but does not carry the generator, the
+  // declared absent/failed-addon state is the answer, exactly as `boundaryReject` takes it — and where a
+  // marked value carries no usable slots the handler below answers it, so no unsubstituted placeholder can
+  // reach a caller from this frame.
+  const usable = typeof addon_.errorMessage === 'function'
+    && typeof refusal.status === 'string'
+    && typeof refusal.segment === 'string';
+  if (usable === false) throw refusal;
+  const generated = addon_.errorMessage(refusal.status, refusal.segment, refusal.container);
+  // **THE FORM IS THIS SURFACE'S ONE FORM** (`§2.5` items 3–4, whose `log` is PRESENT and never absent):
+  // `{status, message, log}`, the `status` the STORE's `ConstraintListInvalid`, the `message` the STORE'S
+  // OWN GENERATED SENTENCE, and the `log` the synthetic attempt's log where a repair was attempted and `[]`
+  // where none was. **NO `KC` TOKEN CROSSES** (`A120` (2); `§2.12` item 3 item 2): the synthetic attempt's
+  // terminal token stays in the kernel and reaches no caller.
+  throw {
+    status: refusal.status,
+    message: generated,
+    log: refusalLog(refusal.log),
+  };
+}
+
 /// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
 /// `true` is the only pass value). **THE ELEMENT IS PARKED AND NEVER WITHDRAWN**: `constraintOn` re-registers
 /// `entry.fn`, so *"it is the element the entry carried at that pair — never a second constraint and never a
@@ -2837,12 +3083,13 @@ function constraintParked() {
 /// `PAR-JS-24`'s second declared answer: at EITHER toggle, in EITHER direction, an OUTSIDE VALUE taking
 /// item 4's refusal, ONE THROWN `TypeError`, THE ENTRY NOT WIDENED.** It is NOT a third population route:
 /// were the entry widened with the function the refused call carried, a pair would stand ENABLED WITH NO
-/// FUNCTION — a state no clause of that directory declares.
+/// FUNCTION — a state no clause of that directory declares. **AND IT IS THAT SAME ONE `TypeError`, carrying
+/// `log: []` on the ruling's flat reading and no `status` on rule (ii)'s** (`surface.md §2.5` item 4).
 function constraintUncarried(verb, pair) {
-  throw new TypeError(
+  throw withEmptyLog(new TypeError(
     `the pair at the ${ARGUMENT_POSITION_FIRST} of \`${verb}\` carries no constraint in this instance, and `
     + 'a toggle names a pair the entry carries',
-  );
+  ));
 }
 
 /**
@@ -2862,7 +3109,16 @@ function addConstraint(instance, n, pair, constraint) {
   if (held === undefined) {
     return carryConstraint(site.state, instance, site.address, site.id, constraint).identity;
   }
-  constraintsKernel().register(instance, site.address, site.id, constraint);
+  // **THE OVERWRITE ARM TAKES THE SAME THREE-STATE REGISTRATION** (`§2.12` item 3's clause of 2026-10-16
+  // read at its `A135` (3) mark): a second ADD at a held pair registers the supplied function through `K-1`
+  // exactly as the fresh arm does, so a registration the store REFUSES refuses THIS call too — and the held
+  // element is left EXACTLY AS IT STOOD, because the entry's own record is written only after the
+  // registration returns (`§2.12` item 3: *"NO identity is returned and NO element is carried"*).
+  try {
+    constraintsKernel().register(instance, site.address, site.id, constraint);
+  } catch (refusal) {
+    registrationCrossing(refusal);
+  }
   held.fn = constraint;
   held.enabled = true;
   return held.identity;
@@ -2889,12 +3145,70 @@ function constraintToggle(enabled, instance, n, pair, constraint) {
   const entry = site.state.constraints.get(constraintPairKey(site.address, site.id));
   if (entry === undefined) constraintUncarried(verb, pair);
   if (entry.enabled !== enabled) {
-    constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    // **THE ENABLE HALF RE-REGISTERS THE PAIR'S OWN FUNCTION, SO IT TAKES THE SAME THREE-STATE REGISTRATION
+    // AS EVERY OTHER REGISTRATION SITE** (`§2.12` item 3's clause of 2026-10-16 at its `A135` (3) mark;
+    // `docs/specs/storeroom-native/contract.md §7.3` (b)). A registration the store REFUSES refuses THIS
+    // call in the same one form, and the pair's own `enabled` member is UNMOVED — written only after the
+    // registration returns — so a refused toggle leaves the pair exactly as it stood.
+    try {
+      constraintsKernel().register(instance, site.address, site.id, enabled ? entry.fn : constraintParked);
+    } catch (refusal) {
+      registrationCrossing(refusal);
+    }
     entry.enabled = enabled;
   }
   return undefined;
 }
 
+/// **THE REGISTERED-PAIR READ — `surface.md §2.4` item 9 (f)'s `constraints` clause of 2026-10-17, items 2–8,
+/// AND ITS REGISTER ROW `PAR-JS-27` (`parameter-semantics.md §2.27`).** `a.constraints() -> Array<{ address,
+/// id }>`: **a FRESH JS ARRAY on every call, whose every element is a FRESH PLAIN OBJECT carrying EXACTLY
+/// TWO MEMBERS** — `address`, a FRESH JS array of the store's own segments, and `id`, the constraint's own
+/// BARE `id`, a `string` — the same two data the kernel's own registry is keyed by.
+///
+/// **THE SOURCE IS THE ENTRY'S OWN `state.constraints`, AND ITS SHAPE IS ALREADY THE ANSWER'S**: a per-instance
+/// `Map` keyed by `constraintPairKey(address, id)` whose every value is the record `carryConstraint` writes —
+/// `{ address, addressKey, id, fn, enabled, identity }`. So the read is a CARRIAGE READ and no kernel item is
+/// touched or minted: `K-1`–`K-5` stand exactly as printed, the kernel's extent stays FIVE and no `K-6` is
+/// proposed (`§2.4` item 9 (f), item 8). **NO KERNEL MODULE IS EVEN LOADED HERE** — `constraintsKernel()` is
+/// not called, so a product that never carried and never asked for a constraint still reads `[]` on a tree
+/// that stages nothing beside it (`kernel-surface.md §1` item 1's lazy resolution).
+///
+/// **THE FOUR DECLARED EXCLUSIONS, EACH HONOURED AT THIS SITE AND NAMED HERE SO THE CODE CAN BE READ AGAINST
+/// THEM:**
+/// * **(1) NO CONSTRAINT FUNCTION IS RETURNED** (item 3, four grounds, the operative one for this frame being
+///   the anti-pattern rulings: *do not hand out a value whose later use the contract cannot bound*). The
+///   element is BUILT FRESH from `entry.address` and `entry.id`, so `entry.fn` is never read, referenced or
+///   copied — and a disabled pair's parked stub is not reachable either, because a function is never touched
+///   at all.
+/// * **(2) NO OPAQUE IDENTITY IS EXPOSED** (item 4; `PAR-JS-25`'s opacity would break the moment a consumer
+///   read one out of the array). `entry.identity` is not read and no element carries it.
+/// * **(3) NO ORDER IS PROMISED, AND NONE IS MANUFACTURED** (item 6): the enumeration is `Map` iteration order
+///   and nothing else — **this function does NOT sort, and deliberately does not** — so a drive compares the
+///   pairs as a SET and never as a sequence (`DD-22`; `§2.7` item 3). No registration order, address order or
+///   `seq`-like ordinal is minted here, and none is asserted of it.
+/// * **(4) A DISABLED PAIR DOES APPEAR** (item 5): `constraintOff` is a TOGGLE and NOT A REMOVAL, so a pair
+///   whose `entry.enabled` is `false` is STILL CARRIED and is enumerated — **the read does not consult
+///   `enabled` at all**, and it returns no `enabled` member either (a third member is a value no clause
+///   declares).
+///
+/// **AND THE TWO EXCLUSIONS ITEM 7 DECLARES ARE STRUCTURES AND NOT TESTS TAKEN HERE**: (i) a well-formed
+/// `cfg.constraints` element that carried no function never reached `carryConstraint` (`storeCreate`'s batch
+/// loop skips it), so it is no entry and cannot appear; and (ii) a refused registration wrote no entry
+/// (`carryConstraint`: *"THE ENTRY'S OWN RECORD IS WRITTEN ONLY WHERE THE REGISTRATION STOOD"*), so it
+/// cannot appear either. **THE SAME TWO MEMBERS ON EVERY ELEMENT AND NO THIRD**, and the `[]` arm is this
+/// member's declared value where the entry carries no pair at all (`PAR-JS-27`'s `domain` cell).
+function enumerateConstraints(state) {
+  const pairs = [];
+  for (const entry of state.constraints.values()) {
+    // A FRESH PLAIN OBJECT PER CALL AND A FRESH SEGMENT ARRAY WITHIN IT (`slice`): a caller that mutates a
+    // returned element, or an element's `address`, changes nothing the next call returns — and nothing of the
+    // entry's own record either, the two members being copies of the pair's own data.
+    pairs.push({ address: entry.address.slice(), id: entry.id });
+  }
+  return pairs;
+}
+
 /// **WHETHER THIS INSTANCE CARRIES A PAIR AT THIS WRITE'S ADDRESS** (`§2.12` item 1's preamble clause (a)) —
 /// the gate stage 1 takes before the kernel is reached at all. **THE CLASS DECISION COMES FIRST AND NO TRAP
 /// IS RUN ON ANY PATH** (`DD-34`): a `Proxy` address, a class extending `Array` and every non-array lies
@@ -2941,19 +3255,155 @@ function constraintWrite(state, instance, address, tier, value) {
 }
 
 /// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
-/// STORE'S.** `§2.12` item 1's read-through clause fixes what crosses here: **A PLAIN OBJECT OF EXACTLY THE
-/// TWO MEMBERS `status` AND `message`, `status` A STRING DRAWN FROM THE STORE'S CLOSED `16`-MEMBER SET, the
-/// kernel's third member `log` ABSENT AND UNREACHABLE.** The member `status` carries is the store's
-/// `FileCommitFailed`, because no caller-side status can carry a `KC` token and a constraint-refused write
-/// is a commit that did not stand. **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED** (`§1.2`).
+/// STORE'S — AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16** (`surface.md §2.5`'s clause of that
+/// date, items 3–4 and 10 (i)–(iii); `§2.12` item 1's mark of the same date).
+///
+/// **WHAT MOVES IS THE REACHABILITY OF `log` AND NOTHING ELSE.** The member `status` carries is still the
+/// store's `FileCommitFailed`, because no caller-side status can carry a `KC` token and a
+/// constraint-refused write is a commit that did not stand; **the kernel token does NOT enter `status`**
+/// (`A120` (2)'s rule survives whole). **A STORE VERB'S OWN REFUSAL CROSSES VERBATIM AND UNCONVERTED**
+/// (`fail-surface.md §1.2`): its `status` and its `message` are carried BYTE-FOR-BYTE, never re-mapped and
+/// never re-spelled, and `log` is ATTACHED BESIDE them as an own member — *"nothing is converted, and a
+/// member is added"* (`§2.5` item 10 (ii)).
+///
+/// **THE TWO ARMS, EACH AT ITS OWN FORM:**
+/// * **A `KC`-TOKEN REFUSAL — THE KERNEL'S OWN PASS PRODUCED IT.** Its `{status, message, log}` is the
+///   KERNEL'S OWN three-member form (`docs/specs/storeroom-constraints/fail-surface.md §1.1`, whose member
+///   set is the same three), and it would cross UNCHANGED were it not that `status` must carry the store's
+///   `FileCommitFailed` on this surface: **the `log` it carries is the attempt's, VERBATIM, and it crosses
+///   with the store-side `status` in its place.**
+/// * **A STORE VERB'S OWN REFUSAL.** Its `status` and `message` cross verbatim and `log` is attached beside
+///   them — the attempt's log where this write's own attempt holds one, and `[]` where it does not (a `K-2`
+///   the store refused opened no attempt, so there is no attempt at all — `§2.5` item 4).
+///
+/// **AND THE TIMING TRAP IS HONOURED, WHICH IS THE WHOLE OF ITEM 10 (iii): `log` IS TAKEN BEFORE THE
+/// ATTEMPT IS DISPOSED OF, NOT AFTER.** The kernel's terminal act has already run when this frame is
+/// reached (its `refuse` was thrown WITH the log in hand, `constraint-kernel.mjs`'s `refuse`), so the list
+/// read here is the list AS IT STOOD WHEN THE REFUSAL WAS BUILT — the failure arm's `outcome` entry
+/// included — and it is read OFF THE THROWN VALUE AND NEVER OFF A LATER READ: the registry entry is gone
+/// and a reader that reached for the attempt afterwards would reach nothing.
+///
+/// **⟶ THE FORGERY DISCRIMINATOR, RE-EXAMINED AND REPLACED 2026-10-16, BECAUSE THE RULING MADE THE OLD ONE
+/// UNSAFE — THIS IS THE HIGH-RISK EDIT AND IT IS NAMED WITH WHAT IT WAS AND WHAT IT IS.**
+///
+/// **WHAT IT WAS.** The previous pass fixed a broken forgery guard by discriminating on **`log`'s
+/// PRESENCE**: *a value carrying a `log` was the kernel's, and a value carrying none was the caller's.*
+/// That was sound only while the KERNEL'S OWN form was the only three-member form in the system.
+///
+/// **WHY IT NO LONGER SUFFICES.** `surface.md §2.5` item 4 now declares **`log` flat on EVERY failure this
+/// surface throws** — so every surface-produced failure carries one, **and so does a CALLER'S forged object
+/// that happens to carry a `log` member.** A caller's constraint body may throw
+/// `{status: 'ValueNotAdmitted', message: 'FORGED BY THE CALLER', log: []}` — a plain object it authored,
+/// carrying the member the old test looked for — **and under the old test that object was RE-WRAPPED into a
+/// fresh three-member object, so `caught === thrown` was `false` for a value the caller threw.** Measured on
+/// the tree before this edit: `forged {status,message,log} => caught===thrown: false`. **A caller's own
+/// throwable must surface AS ITSELF** (`fail-surface.md §1.1` item 5 — the body's exception *"propagates out
+/// of the kernel's own invocation, untouched and unconverted"*; `kernel-surface.md §2.3` item 1 — a body's
+/// throwable *"is NOT a kernel state and NOT a store state"*), **so the test had to stop reading a member
+/// the caller can forge.**
+///
+/// **WHAT REPLACED IT — IDENTITY, NOT SHAPE.** The kernel's own refusals are **built by the kernel**, and
+/// every one of them is thrown from `constraint-kernel.mjs`'s single `refuse` frame. The entry therefore
+/// **MARKS WHAT THE KERNEL BUILT**, at the one place the kernel's values enter this entry, **with a
+/// module-private `WeakSet`** — `kernelRefusals` above — **and this frame asks whether the handed value IS
+/// ONE OF THOSE VALUES, never whether it LOOKS LIKE one.** A caller cannot forge membership of a set it
+/// cannot reach, so:
+/// * a `KC`-token value the kernel built → **the kernel's arm**, and `FileCommitFailed` crossings below;
+/// * a store verb's own refusal (built by the addon, carrying the store's code) → the store's arm below;
+/// * **EVERYTHING ELSE IS THE CALLER'S AND CROSSES AS ITSELF** — a forged three-member object, a forged
+///   two-member object, a `TypeError`, a bare string, `undefined` — `caught === thrown` on all of them.
+///
+/// **THE MARK IS SET WHERE THE KERNEL'S FAILURE IS FIRST SEEN** — at the two `catch` frames in
+/// `constraintWrite` above, which are the only places a kernel-thrown value reaches this entry — and **NOT
+/// by a test over members, which is the whole defect being repaired.** **IT IS A `WeakSet` AND NOT A MEMBER
+/// ON THE VALUE**: no member is added to the kernel's own form (`fail-surface.md §1.1`'s member set stays the
+/// three), nothing is mutated, nothing is frozen, and the mark is invisible to every census — while a value
+/// that is not an object (a string, `undefined`) is simply never in the set and needs no special case, since
+/// `WeakSet.has` on a primitive is `false` rather than a throw.
+/// **THE KERNEL'S OWN REFUSAL-CLASS QUESTION, AND WHY THE ENTRY ASKS THE KERNEL IT RATHER THAN READING A
+/// MEMBER** — the discriminator that replaced `log`'s presence, and the reason a `WeakSet` local to this
+/// entry will not do.
+///
+/// **THE MARK CANNOT LIVE HERE, AND THAT WAS MEASURED RATHER THAN REASONED:** a `WeakSet` populated from the
+/// two `catch` frames in `constraintWrite` marks **EVERY** value leaving the kernel's frames — **a caller's
+/// constraint BODY throws from inside `runAttempt` too**, so the body's own throwable passes the same frame
+/// and is marked alongside the kernel's. On the tree with the `WeakSet` in place, all three of
+/// `forged {status,message}`, `forged {status,message,log}` and `TypeError` answered `caught === thrown:
+/// false`: **the mark was set by the frame and not by the author of the value.** A mark is only worth
+/// anything if the thing that SETS it is the thing that BUILT the value, and for a kernel refusal that thing
+/// is `constraint-kernel.mjs`'s own `refuse`.
+///
+/// **SO THE KERNEL DECLARES IT, AT ITS ONE THROW SITE, UNDER A `Symbol.for` KEY BOTH SIDES SPELL** — exactly
+/// the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM` already use across this
+/// same boundary (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`): the entry imports no kernel at load and the
+/// kernel imports no entry, and **a symbol key is invisible to `Object.keys`**, so the thrown form's readable
+/// member set stays the three `§2.5` items 3–4 declare (`§2.5` item 9's census reads `["log","message",
+/// "status"]` and no fourth). **A CALLER'S BODY CANNOT SET IT**: the mark is written in a frame no caller
+/// reaches, and it is not a member a caller would think to spell.
+///
+/// **AND A KERNEL THAT DID NOT CARRY THE DECLARATION ANSWERS `false`** — every value is then the caller's and
+/// surfaces as itself, which is the safe direction: a refusal crossed unconverted is the declared form once
+/// the surface stops re-wrapping it, while a caller's value crossed converted is the FINDING this whole
+/// discriminator exists to prevent.
+
+/// **THE SAME `Symbol.for` KEY THE KERNEL WRITES, SPELLED HERE SO THE ENTRY IMPORTS NO KERNEL AND THE KERNEL
+/// IMPORTS NO ENTRY** — the pattern `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM`
+/// already cross this boundary by (`constraint-kernel.mjs`'s `KERNEL_REFUSAL`).
+///
+/// **IT IS A SYMBOL AND NOT A KERNEL FUNCTION, AND THE REASON IS A SPEC COUNT: `kernel-surface.md §1` item 2
+/// declares that module's export set as EXACTLY the five `K-1`–`K-5` items — *"no sixth name"* — so a
+/// predicate exported from the kernel to serve this entry would be a FINDING.** The fact travels on the
+/// VALUE, under a key both sides spell, and the kernel's namespace is untouched.
+///
+/// **THE QUESTION IS ANSWERED WITHOUT REACHING THE KERNEL AT ALL**, which is the shape `WeakSet.has` gave
+/// for free and is what lets this entry keep loading where nothing is staged beside it: no `require` of
+/// `./src/` is triggered by a failure's own classification.
+const KERNEL_REFUSAL = Symbol.for('provident-storeroom.kernel-refusal');
+
+/// **WHETHER THE HANDED VALUE IS A REFUSAL THE KERNEL ITSELF BUILT** — the discriminator that replaced
+/// `log`'s presence, answered by the mark the kernel's one `refuse` frame sets and by nothing a caller can
+/// spell. **A NON-OBJECT IS `false`** without a member read, and **a value the kernel never built is
+/// `false`** whatever members it carries.
+function isKernelBuiltRefusal(value) {
+  return value !== null && typeof value === 'object' && value[KERNEL_REFUSAL] === true;
+}
+
 function constraintCrossing(refusal) {
-  const status = refusal !== null && typeof refusal === 'object' ? refusal.status : undefined;
-  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) throw refusal;
+  const isObject = refusal !== null && typeof refusal === 'object';
+  const status = isObject ? refusal.status : undefined;
+  // **THE CALLER'S OWN VALUE CROSSES AS ITSELF, FIRST AND UNCONDITIONALLY.** The test is IDENTITY against
+  // the kernel's marked set (above) and NOT any member's presence: a caller's forged `log`, a forged
+  // `status` spelling and a forged two-member object are all its own, and `caught === thrown` holds for
+  // each (`fail-surface.md §1.1` item 5). A value that is not an object at all is never the kernel's either.
+  if (!isObject || isKernelBuiltRefusal(refusal) === false) throw refusal;
+  // THE LOG IS THE THROWN VALUE'S OWN `log` MEMBER — the same list either arm carries — and `[]` where the
+  // value carries none (`§2.5` item 4: never absent, never `null`, never a non-array; a non-array here is a
+  // finding at the site that produced it and is answered with the empty array rather than a shape).
+  // **AND IT IS TAKEN HERE, BEFORE THE ATTEMPT IS DISPOSED OF** — item 10 (iii)'s timing trap: the list is
+  // READ OFF THE THROWN VALUE, which the kernel built with the log in hand, and never off a later read.
+  const log = Array.isArray(refusal.log) ? refusal.log : [];
+  // **A MARKED VALUE WHOSE `status` IS NOT A `KC` TOKEN IS THE STORE VERB'S OWN REFUSAL CROSSING BACK
+  // THROUGH THE KERNEL'S OWN LEG** (`constraint-kernel.mjs`'s `attempt.throwState` carries the store's code
+  // at the repair arm): its `status` and `message` cross VERBATIM and `log` is attached BESIDE them —
+  // *"nothing is converted, and a member is added"* (`§2.5` item 10 (ii)).
+  if (typeof status !== 'string' || KC_TOKENS.includes(status) === false) {
+    throw {
+      status: refusal.status,
+      message: refusal.message,
+      log: refusalLog(log),
+    };
+  }
+  // **THE KERNEL'S OWN `KC` REFUSAL.** Its `{status, message, log}` is the KERNEL'S OWN three-member form
+  // (`docs/specs/storeroom-constraints/fail-surface.md §1.1`), and it crosses with the STORE's
+  // `FileCommitFailed` in `status` because no caller-side status can carry a `KC` token and a
+  // constraint-refused write is a commit that did not stand: **the kernel token does NOT enter `status`, and
+  // the `log` it carries is the attempt's, VERBATIM.**
   throw {
     status: 'FileCommitFailed',
     message: typeof refusal.message === 'string'
       ? refusal.message
       : 'the write was refused by a constraint of this attempt',
+    log: refusalLog(log),
   };
 }