provident-storeroom 0.3.1 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -38,11 +38,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.3.1",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.3.1",
-    "@auspicion/provident-storeroom-js-darwin-x64": "0.3.1",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "0.3.1",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.3.1"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.5.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.5.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "0.5.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "0.5.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.5.0"
   },
   "publishConfig": {
     "access": "public"

package/src/constraint-kernel.mjs

@@ -131,8 +131,27 @@ const SETTLED_ON_THE_PASSING_ARM = Symbol.for('provident-storeroom.settled-on-th
 const SAVE_FAILED_AT_THE_TERMINAL_ARM = Symbol.for('provident-storeroom.save-failed-at-the-terminal-arm');
 
 /** `fail-surface.md §1.1` — ONE THROWN PLAIN OBJECT, EXACTLY THREE MEMBERS, NEVER AN `Error`. */
+const KERNEL_REFUSAL = Symbol.for('provident-storeroom.kernel-refusal');
 function refuse(status, message, log) {
-  throw { status, message, log: log === undefined ? [] : log };
+  throw {
+    status,
+    message,
+    log: log === undefined ? [] : log,
+    [KERNEL_REFUSAL]: true,
+  };
+}
+
+/// **WHETHER A VALUE IS A REFUSAL THIS KERNEL BUILT** — the entry's crossing and this kernel's own repair
+/// arm both ask this and nothing else.
+///
+/// **IT IS NOT AN EXPORT, AND THE REASON IS THE SPEC'S OWN CLOSED COUNT:** `kernel-surface.md §1` item 2
+/// declares the module's export set as **EXACTLY the five `K-1`–`K-5` items** — *"the kernel exports no
+/// route, no addon handle and no sixth name"* — so a predicate exported from here would be a SIXTH NAME and
+/// a FINDING. **The mark is therefore read through the `Symbol.for` key itself, which both sides spell**
+/// (`KERNEL_REFUSAL` above), and the fact travels on the VALUE rather than in the module's namespace —
+/// exactly as `SETTLED_ON_THE_PASSING_ARM` and `SAVE_FAILED_AT_THE_TERMINAL_ARM` already travel.
+function isKernelRefusal(value) {
+  return value !== null && typeof value === 'object' && value[KERNEL_REFUSAL] === true;
 }
 
 // ---------------------------------------------------------------------------------------------
@@ -380,9 +399,364 @@ export function register(store, address, id, constraint) {
   } else {
     standing.constraint = constraint;
   }
+
+
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  // THE THIRD STEP — THE REGISTRATION-TIME EVALUATION (`docs/specs/storeroom-native/contract.md §7.3`
+  // (b) states 1–3 and its `3-bis` clause of 2026-10-16; `kernel-surface.md §2.1` item 1's third step).
+  // ═══════════════════════════════════════════════════════════════════════════════════════════════
+  //
+  // **WHAT THIS STEP OWES, IN THE RULING'S OWN TERMS: after channels (i) and (ii) are passed and the pair
+  // stands in the registry, the kernel EVALUATES THAT ONE CONSTRAINT AGAINST THE STORE'S CURRENT STATE,
+  // ONCE, BEFORE THE HANDLE IS RETURNED.** The scope is THAT ONE PAIR and no other: no pass is opened over
+  // the registry and no other registered pair is re-evaluated.
+  //
+  // **⟶ THE THREE STATES, EACH ANSWERED HERE AND AT NO OTHER SITE:**
+  //   (i)   the state PASSES → the call returns the handle exactly as before, and nothing else happened;
+  //   (ii)  it VIOLATES and NO repair is registered → the registration is REFUSED;
+  //   (iii) it VIOLATES and a repair IS registered → THE REPAIR IS ATTEMPTED on the synthetic attempt
+  //         `3-bis` (a) declares, and its outcome answers the call as (i) or as (ii).
+  //
+  // **AND WHAT THE KERNEL HANDS THE SURFACE IS A CODE AND ITS SLOTS, NEVER A SENTENCE.** This module owns
+  // no message generator, and `kernel-surface.md §1` item 2 closes its surface at the FIVE `K-1`…`K-5`
+  // items with no sixth name — so it imports none, is handed none, and declares no channel to one. The
+  // refusal it throws carries `status` (the STORE's member, `A120` (2)) and the `§8.2` row's own slot
+  // VALUES, and the surface renders the text through the generator it already holds. **NO `KC` TOKEN IS
+  // MINTED:** the synthetic attempt's own terminal token stays inside this module (`registrationRefusal`).
+  const refused = registrationEvaluation(kernel, store, address, id, constraint);
+  if (refused !== null) {
+    // **A REFUSED REGISTRATION LEAVES THE REGISTRY EXACTLY AS IT STOOD** (`§2.1` item 1's sentence, whose
+    // regulatory force reaches this third refusing act — `§7.3` (b) state 2's own reading of it): the pair
+    // row this call wrote is withdrawn, with its handle and its place in the address's order list.
+    withdrawRegistration(kernel, address, id, standing === undefined, home);
+    throw refused;
+  }
+  return home;
+}
+
+/**
+ * **WITHDRAWING THE REGISTRY ROW A REFUSED REGISTRATION WROTE** — `kernel-surface.md §2.1` item 1: *"a
+ * refused registration leaves the registry exactly as it stood"*, read at `docs/specs/storeroom-native/
+ * contract.md §7.3` (b) state 2 by that item's own clause (*"the sentence's `2` counts `KC` CHANNELS and
+ * the registration-time refusal is a THIRD REFUSING ACT carrying no `KC` token, so the sentence's FIGURE IS
+ * UNMOVED while its regulatory force (no entry on a refusal) reaches this third act"*).
+ *
+ * **WHAT IT UNDOES IS THIS CALL'S OWN WRITE AND NOTHING ELSE**, which is why the prior-standing fact is
+ * passed in: on the FRESH arm the pair row, its handle and its address-list entry all go; on the
+ * REPLACEMENT arm (a second `register` under a pair that already stood) the row's own POSITION and handle
+ * are left exactly as they were — the pair's idempotence rule (`CC-7`) puts the replaced registration's
+ * position back by never moving it.
+ */
+function withdrawRegistration(kernel, address, id, fresh, home) {
+  if (!fresh) return;
+  const key = pairKey(address, id);
+  kernel.pairs.delete(key);
+  kernel.handles.delete(key);
+  const token = addressToken(address);
+  const list = kernel.byAddress.get(token);
+  if (list !== undefined) {
+    const at = list.indexOf(key);
+    if (at >= 0) list.splice(at, 1);
+    if (list.length === 0) kernel.byAddress.delete(token);
+  }
+  // THE ADDRESS'S HOME ENTRY STANDS: it was minted by the store's own `listen`, which this act has already
+  // performed, and no clause of this unit declares a kernel-side withdrawal of it (`§2.1` item 1: *"nothing
+  // withdraws a constraint's store registration"* — `unlisten` is the app's own verb and never this one's).
   return home;
 }
 
+/**
+ * **THE REGISTRATION-TIME EVALUATION, AT ITS ONE SITE** (`docs/specs/storeroom-native/contract.md §7.3`
+ * (b) and its `3-bis` clause of 2026-10-16; `kernel-surface.md §2.1` item 1's third step and `§2.3` item
+ * 1's clause of 2026-10-17). It answers `null` on state 1 and on state 3's passing arm, and **the refusal
+ * to throw** on state 2 and on state 3's failing one.
+ *
+ * **THE EVALUATION'S CONTEXT IS `§2.3` ITEM 1'S CLAUSE OF 2026-10-17, MEMBER FOR MEMBER, AND IT IS THE
+ * SAME FIVE MEMBERS AS AT A LANDING** — `address` the pair's own; `tier` ABSENT, spelled `null`; `value`
+ * THE STORE'S CURRENT VALUE AT THE PAIR'S ADDRESS, READ AND NOT LANDED; `attempt` the synthetic attempt's
+ * `AttemptRef` on state 3 and `null` on states 1/2; `op` ABSENT, spelled `null`. **A SIXTH MEMBER IS
+ * REFUSED BY NAME** (`5 + 1 = 6` is refused at that item's (6)), and both `null`s are THAT CLAUSE's own
+ * spellings of an absence inside a closed record, taken from the `RollbackStep.checkpoint` precedent, and
+ * are not tokens minted here.
+ *
+ * **THE `value` IS OBTAINED BY THE STORE'S OWN `read` AT THE PAIR'S ADDRESS WITH THE TIER ARGUMENT
+ * OMITTED** — the zero-tier call — **and where that read REFUSES `AddressNotFound` the member carries
+ * `undefined`**, which is that clause's (3) (e) arm. **NO `null` IS MINTED FOR IT** (`DD-12` forbids a
+ * READ answering one) and no `AddressNotFound` code is put in a `Value` slot: the fresh-pair outcome is
+ * the CALLER'S OWN BODY's answer to absence, and no clause decides which a given body is.
+ *
+ * **⟶ AND THE BODY'S OWN THROW IS NOT CONVERTED HERE.** A throw out of the constraint body at this instant
+ * SURFACES AS ITSELF (`fail-surface.md §1.1` item 5, at `kernel-surface.md §2.3` item 1's clause of
+ * 2026-10-17): not re-shaped into this module's form, not wrapped, and carrying no `KC` token. So the
+ * invocation below is NOT wrapped — a throwing body reaches the caller as the very value it threw.
+ */
+function registrationEvaluation(kernel, store, address, id, constraint) {
+  const outcome = constraint(registrationContext(store, address, null));
+  // THE OUTCOME IS `PAR-C-5`'S CLOSED THREE-ARM SET, read as the landing pass reads it: `true` is the pass
+  // arm; an object carrying `message` is the violation arm (its `repair`, where present, the repair the
+  // caller registered); a value outside the three arms is READ AS the `{message}` arm (`VA-11`) and never as
+  // an arm of its own. **A REPAIR THE OUTCOME DOES NOT CARRY IS NO REPAIR REGISTERED FOR THE PAIR.**
+  if (outcome === true) return null;
+  const repair = outcome !== null && typeof outcome === 'object' && 'message' in outcome
+    && 'repair' in outcome && typeof outcome.repair === 'function'
+    ? outcome.repair
+    : null;
+  // STATE 2 — THE STATE VIOLATES IT AND NO REPAIR IS REGISTERED. Nothing is attempted and no attempt is
+  // opened; the refusal carries the store's code and the row's own slots.
+  if (repair === null) return registrationRefusal(address, id, []);
+  // STATE 3 — THE REPAIR IS ATTEMPTED, on the synthetic attempt `3-bis` (a) declares.
+  return registrationAttempt(kernel, store, { address, id, repair });
+}
+
+/// **THE FIVE-MEMBER EVALUATION CONTEXT** (`kernel-surface.md §2.3` item 1's clause of 2026-10-17), built
+/// at ONE site so states 1, 2 and 3 hand the caller's body the SAME record and only `attempt` moves:
+/// `null` on states 1 and 2, the synthetic attempt's `AttemptRef` on state 3.
+function registrationContext(store, address, attemptRef) {
+  return {
+    address: address.slice(),
+    // `tier` — ABSENT, and `op` — ABSENT: the two members carrying the landing's own absence, spelled
+    // `null` on that clause's (2) and (5).
+    tier: null,
+    // `value` — READ, not landed, and `undefined` at an address holding nothing (that clause's (3) (e)).
+    value: readCurrent(store, address),
+    attempt: attemptRef,
+    op: null,
+  };
+}
+
+/// The store's current value at an address, read NOT landed: the zero-tier call whose tier argument is
+/// OMITTED, and `undefined` where that read refuses.
+function readCurrent(store, address) {
+  try {
+    return store.read(address);
+  } catch (refused) {
+    return undefined;
+  }
+}
+
+/**
+ * **THE SIX-MEMBER `RepairContext` THE REPAIR IS HANDED AT REGISTRATION** (`kernel-surface.md §2.3` item
+ * 2's shape, its sixth member `pending: Handle[]` added 2026-10-15; `surface.md §2.11` clause 6, the one
+ * home of the architect's ruling that a repair *"IS PASSED THE COMMIT IT IS PART OF"*).
+ *
+ * **THE REPAIR'S CONTEXT IS NOT THE CONSTRAINT'S CONTEXT, AND THE TWO ARE NOT INTERCHANGEABLE**: the
+ * constraint receives the FIVE-member `AttemptContext` and the repair the SIX-member `RepairContext`, whose
+ * extra member is the commit's own `pending` — *"so that they can make their own write call use that
+ * commit"*. **THE SYNTHETIC ATTEMPT'S OWN `commit` MEMBER IS WHAT THIS SLOT CARRIES** (`3-bis` (a): *"the
+ * `CommitRecord` of the registration act"*), handed as a FRESH LIST the way the landing instant hands it, so
+ * the record's member is never aliased and a repair that mutated its context's list moves nothing on the
+ * commit.
+ *
+ * **AND THE ABSENCE AT THIS INSTANT IS SPELLED BY THE `AttemptContext`'S OWN CLAUSE, NOT MINTED HERE:** there
+ * is no landing, so `op` is `null` (that clause's (5)) and `tier` is `null` (its (2)) — the two absences the
+ * `RollbackStep.checkpoint` precedent already fixes — while `value` is the store's CURRENT value at the
+ * pair's address, read and not landed (its (3)). **`id` IS THE PAIR'S OWN**, which the constraint's context
+ * does not carry at all, the repair's shape declaring it.
+ */
+function registrationRepairContext(store, address, id, commitRecord) {
+  return {
+    address: address.slice(),
+    id,
+    // `tier` — ABSENT, spelled `null`; `value` — READ, not landed; `op` — ABSENT, spelled `null`.
+    tier: null,
+    value: readCurrent(store, address),
+    op: null,
+    // THE COMMIT THE REPAIR IS PART OF — a FRESH LIST, never the record's own member (`§2.3` item 2).
+    pending: Array.isArray(commitRecord.pending) ? commitRecord.pending.slice() : [],
+  };
+}
+
+/**
+ * **STATE 3 — THE SYNTHETIC ATTEMPT AND THE REPAIR IT CARRIES** (`docs/specs/storeroom-native/contract.md
+ * §7.3` (b) `3-bis` (a)–(f); `attempt-lifecycle.md §2.4` items 1, 3, 4 arm (b)).
+ *
+ * **THE ATTEMPT'S RECORD IS ITEM 1's NINE MEMBERS UNCHANGED — NO TENTH MEMBER IS MINTED AND NO MEMBER'S
+ * DOMAIN MOVES:** `ref`, `commit`, `ops`, `log`, `ran`, `appliedRepairs`, `open`, `rollback`, `checkpoint`.
+ * **ITS `address` IS THE PAIR'S OWN**, **`ITS `checkpoint` BEGINS `null`*** — that member's declared `null`
+ * arm, because no landing at that address has yet left it valid for THIS attempt — and **its `ref` is a
+ * kernel-minted `AttemptRef` unique within the instance**. **Its `log` is a real `LogEntry[]` carrying this
+ * kernel's own `seq` ordinal**, and the `constraint-check` and `repair-run` entries arm (b) appends stand in
+ * it. **IT IS TERMINAL-AWARE ON BOTH ARMS**: it reaches `PASSED` or `FAILING` and closes, and no
+ * registration leaves an open attempt in the registry.
+ *
+ * **THE OP THE REPAIR LANDS IS HELD BY THIS ATTEMPT AND NOTHING ELSE** — `3-bis` (a)'s selection of the
+ * synthetic branch, so principle (1) (*"a repair's op is an attempt's op"*) still binds and no op is
+ * admitted outside one.
+ *
+ * **AND ITS OP LANDS DURABLY** (`3-bis` (f)): the repair's edit goes through the store's OWN verbs, its
+ * `op` is a real `JournalOp` in the store's own journal, readable back through every read verb at that
+ * address, and it stands after the registration returns. **THIS IS NOT A DRY RUN**, and no clause of that
+ * contract may be read as one. **ON SUCCESS NO LOG CROSSES** (`3-bis` (c), under `A135` (1)'s
+ * failure-only bubbling): the caller receives the identity ALONE, and the repair's outcome is carried by
+ * this attempt's own `log` and `ops` — the two carriers that clause fixes.
+ *
+ * **ON FAILURE THE REGISTRATION IS REFUSED** (`3-bis` (d)'s arms (d)/(e)/(f)): the store's
+ * `ConstraintListInvalid` is answered in the SAME form and with the SAME THREE SLOTS as state 2's. The
+ * synthetic attempt's `KC-4`/`KC-5`/`KC-6` **stays inside this module** and reaches no caller, because the
+ * caller's act is the registration and it is the registration that is refused (`§7.3` (e)'s re-reading).
+ */
+function registrationAttempt(kernel, store, pair) {
+  const address = pair.address;
+  const key = pairKey(address, pair.id);
+  ATTEMPTS += 1;
+  const attempt = {
+    ref: { id: `attempt-${ATTEMPTS}` },
+    store,
+    address: address.slice(),
+    tier: null,
+    value: undefined,
+    // `commit` — THE REGISTRATION ACT'S OWN `CommitRecord` (`3-bis` (a)): this kernel's four members, with
+    // no write's op and no write's triggered set, because a registration lands no `K-2` of its own.
+    commit: { attempt: null, op: null, triggered: [], pending: [] },
+    write: null,
+    ops: [],
+    log: [],
+    ran: [],
+    appliedRepairs: [],
+    rollback: [],
+    checkpoint: null,
+    checkedOff: [],
+    status: 'open',
+    report: null,
+  };
+
+  // ARM (b) VERBATIM: the `constraint-check` entry and the `repair-run` entry are appended, the repair runs
+  // through the caller's own verb, and the op its `{ok: true, op}` return names is added to `ops` while its
+  // pair is appended to BOTH `ran` and `appliedRepairs` (`3-bis` (b): the pair JOINS both members — of the
+  // SYNTHETIC attempt, and of no other). **THE PAIR ENTERS `ran` BEFORE THE REPAIR RUNS**, which is that
+  // arm's own ordering and is what makes the repeat arms reachable at the re-run below.
+  append(attempt, 'constraint-check', pair.id, null, `the evaluation of ${pair.id}`);
+  attempt.ran.push(key);
+  append(attempt, 'repair-run', pair.id, null, 'the pair\'s repair was attempted at registration');
+
+  let result;
+  try {
+    result = pair.repair(registrationRepairContext(store, address, pair.id, attempt.commit));
+  } catch (body) {
+    // A REPAIR WHOSE BODY THROWS IS A FAILED REPAIR AND THE REGISTRATION IS REFUSED — the caller's act is
+    // the registration, so the refusal is this module's one form (`3-bis` (d); the `KC` boundary at (e)).
+    // **THE BODY'S THROWABLE IS NOT CONVERTED INTO A STORE FORM AND IS NOT REACHED BY THE CALLER HERE**: it
+    // is caught so the attempt can close and the registration can be refused in the declared form; a drive
+    // that expected the body's own value out of `addConstraint` has read a route no clause declares.
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+
+  const ok = result !== null && typeof result === 'object' && result.ok === true;
+  const produced = ok ? landedOp(attempt, result, null) : null;
+  if (produced === null) {
+    // ARM (d) — THE REPAIR PRODUCED NO OP: `{ok: false, message}`, an outside-form return, or an
+    // `ok === true` return whose `op` is absent, `undefined` or not the one it landed.
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+
+  attempt.ops.push(produced);
+  attempt.appliedRepairs.push(key);
+  const entry = attempt.log[attempt.log.length - 1];
+  entry.opId = produced.opId;
+  entry.message = `the repair ${pair.id} landed ${produced.opId}`;
+
+  // THE RE-RUN — `3-bis` (d)'s arms (e)/(f) and `3-bis` (e)'s ordinary landing rules: the repair's op
+  // LANDED, so the pairs registered at ITS OWN landing's address are evaluated by the ordinary pass
+  // (`kernel-surface.md §2.3` item 1), in first-registration order, against THAT op.
+  const failed = registrationRerun(kernel, attempt, produced);
+  if (failed !== null) {
+    closeRegistrationAttempt(attempt);
+    return registrationRefusal(address, pair.id, attempt.log);
+  }
+  // THE PASSING ARM: `PASSED` → `CLOSED` and the registration STANDS. **NO LOG CROSSES**, and the repair's
+  // edit STANDS in the store — the side effect the architect's trust clause licenses (`3-bis` (f)).
+  closeRegistrationAttempt(attempt, 'passed');
+  return null;
+}
+
+/// **THE SYNTHETIC ATTEMPT'S RE-RUN** — every pair standing at the attempt's own address, evaluated once
+/// against the repair's own op (`attempt-lifecycle.md §2.4` item 5 (iv)'s evaluated set, which the
+/// registration instant neither widens nor displaces). Answers `null` where the re-run passes and the arm's
+/// token where it does not.
+///
+/// **THE ARM IS READ OFF THE PAIR THAT FAILED AND OFF NOTHING ELSE** (item 4's disjointness rule): the
+/// pair under repair is IN `ran` — arm (b) wrote it — and arm (b) has just put it in `appliedRepairs`, so a
+/// repeat by the repair's OWN edit reaches `(e)`; a pair IN `ran` and NOT in `appliedRepairs` reaches
+/// `(f)`. **`(c)` is unreachable here**, the pair's own function having already run at this instant.
+function registrationRerun(kernel, attempt, produced) {
+  const list = kernel.byAddress.get(addressToken(attempt.address));
+  if (list === undefined) return null;
+  for (const key of list.slice()) {
+    const pair = kernel.pairs.get(key);
+    if (pair === undefined) continue;
+    const outcome = pair.constraint({
+      address: attempt.address.slice(),
+      tier: produced.tier === undefined ? null : produced.tier,
+      value: produced.after === undefined ? undefined : produced.after.value,
+      attempt: attempt.ref,
+      op: produced,
+    });
+    if (outcome === true) continue;
+    attempt.terminalArm = attempt.appliedRepairs.includes(key) ? 'KC-5' : 'KC-6';
+    return attempt.terminalArm;
+  }
+  return null;
+}
+
+/**
+ * **THE REFUSAL THE REGISTRATION ANSWERS — `ConstraintListInvalid` WITH ITS `§8.2`-GENERATED MESSAGE —
+ * COMPOSED HERE AS A CODE AND ITS SLOTS, AND RENDERED BY THE SURFACE.**
+ *
+ * **⟶ THIS IS THE ROUTE THE ARCHITECT SETTLED, AND IT IS NOT A MESSAGE FROM A SECOND SOURCE.** `DD-52`
+ * forbids a code's message being produced from a second source, and `§8.2`'s one row declares the slots
+ * this instant supplies: **`<CONTAINER>` the pair's own list name, `constraints`**; and **`<SEGMENT>` the
+ * ADDED PAIR's `address` spelling, joined by `/`** — the pair's OWN address and not a failing element's,
+ * because at this instant the entry is WELL-FORMED and the pair is SUBMITTED rather than found wrong.
+ * (`<KEYLIST>`, the row's third slot, is the added pair's members present; no slot of it is asserted here,
+ * `§8.2` clause 3 declaring that the sentence the slots make is asserted by NO clause of that contract.)
+ *
+ * **THE FIXED PHRASE *"is not a valid constraint entry in"* IS RENDERED VERBATIM AND IS NOT RE-AUTHORED** —
+ * `§8.2`'s clause 3 of 2026-10-16, which names the honest consequence: at this instant the sentence's SHAPE
+ * reports an entry that failed its own validity check while the state is a well-formed pair whose FUNCTION
+ * DID NOT PASS. **A HAND-AUTHORED REGISTRATION MESSAGE IS A FAIL OF `P-TP-9` AND NONE STANDS HERE**: not a
+ * byte of the text is written in this module, and the sentence is produced by the store's own generator at
+ * the surface's existing `errorMessage` path.
+ *
+ * **THE VALUE CARRIES THIS MODULE'S OWN MARK** (`KERNEL_REFUSAL`) so the surface can tell it from a
+ * caller's throw, and the mark is set HERE — in the frame that BUILT the value — and never by a test over
+ * members. **A CALLER'S OWN THROWN VALUE STILL SURFACES AS ITSELF**: the 2026-10-17 forgery fix's whole
+ * point, and the five shapes are re-probed with this arm in place.
+ */
+function registrationRefusal(address, id, log) {
+  return {
+    status: 'ConstraintListInvalid',
+    segment: address.map((segment) => String(segment)).join('/'),
+    container: 'constraints',
+    id,
+    log: Array.isArray(log) ? log : [],
+    [KERNEL_REFUSAL]: true,
+  };
+}
+
+/// **THE SYNTHETIC ATTEMPT'S TERMINAL ACT — `PASSED` OR `FAILING`, AND `CLOSED` FROM THOSE TWO AND FROM
+/// NOWHERE ELSE** (`attempt-lifecycle.md §2.4` item 3). It reaches neither the per-op rollback composition
+/// nor the delivery seam: **the registration instant opens no `K-2`, delivers no listener and composes no
+/// rollback** — the repair's edit STANDS on the passing arm (`3-bis` (f)), and a failed repair's own state
+/// is left where the store's own verb left it (`3-bis` (d): the store's state is left where the composition
+/// restored it, which for an attempt with no rollback composed is the state the verb produced).
+function closeRegistrationAttempt(attempt, outcome = 'failed') {
+  attempt.status = 'closed';
+  const report = {
+    attempt: attempt.ref,
+    outcome,
+    ops: attempt.ops.slice(),
+    log: attempt.log,
+    rollback: [],
+  };
+  attempt.report = report;
+  CLOSED.set(attempt.ref.id, report);
+  LIVE.delete(attempt.ref.id);
+  return report;
+}
+
+
 /** The store holds ONE registration per address, and its `listen` takes a function. */
 function noopListener() {}
 
@@ -908,10 +1282,24 @@ function evaluate(kernel, attempt, landing) {
         // (the store's form is `{status, message}`, carrying no `log` member — `§1.2` item 2; the
         // kernel's own form carries three members, and a `KC` token is never named as a store code).
         // The entry's `state` stays `null`; the thrown form's `status` is `KC-4`.
+        // **⟶ THE TEST THAT THIS THROWABLE IS *NOT* THE KERNEL'S OWN WAS `!('log' in body)`, AND THAT
+        // TEST DIED ON 2026-10-16 WITH THE FLAT `log` RULING — THIS IS THE SECOND SITE THE RULING BROKE AND
+        // IS REPORTED AS A FINDING, NOT SILENTLY REPAIRED.** The old test read *"the store's form carries two
+        // members and the kernel's carries three, so a `log` member means the kernel built it"*. **`surface.md
+        // §2.5` item 4 now puts `log` on EVERY failure the JS surface throws, so a STORE REFUSAL REACHING
+        // THIS FRAME THROUGH THE PACKAGE CARRIES A `log` AND THE OLD TEST READ IT AS THE KERNEL'S OWN** —
+        // measured: the two `S-JOIN` `WriteParentNotLink` cells went red with the caller's `status` reading
+        // `WriteParentNotLink` instead of `KC-4`, because `storeCode` was answered `null` and the refusal fell
+        // through to the unconverted `throw body` below.
+        //
+        // **THE REPLACEMENT IS THE SAME ONE THE ENTRY'S CROSSING TOOK — THE KERNEL'S OWN REFUSAL-CLASS MARK
+        // AND NEVER A MEMBER'S PRESENCE** (`KERNEL_REFUSAL` above): a value this kernel built is marked, and
+        // everything unmarked that carries a store code IS a store code, whatever members the surface has
+        // attached to it on its way back. A `KC` token is still never a store code on either spelling.
         const storeCode = body !== null && typeof body === 'object'
+          && isKernelRefusal(body) === false
           && typeof body.status === 'string'
           && body.status.length > 0
-          && !('log' in body)
           && !KC_TOKENS.includes(body.status)
           ? body.status
           : null;
@@ -1237,13 +1625,43 @@ function composeRollback(kernel, attempt) {
   callList.reverse();
   // THE REVERSALS EARLIER RETURNED CALLS PERFORMED — the store's own reports, the only member item 5's
   // "still owes" predicate (and item 5 (a)'s skip) is decided by.
+  //
+  // ⟶ AND THE PREDICATE IS THE MEMBER ALONE, READ AGAINST THE SET IT NAMES — CORRECTED 2026-10-17, AT THE
+  // TEMPORAL-STOP AMENDMENT, AND THE CORRECTION IS NAMED WITH WHAT IT WAS AND WHAT IT IS BECAUSE THIS IS
+  // THE ONE KERNEL EDIT THE AMENDMENT OWES. **WHAT IT WAS:** the guard below was
+  // `!performed.includes(op.opId)`, which is the same reading ONLY WHILE THE STORE'S PER-OP REACH WAS
+  // TOTAL OVER THE WHOLE ADDRESSED SUBTREE — under that reach an op's ABSENCE from every earlier
+  // `undoneOps` member proved a call still owed it, because a call's `undoneOps` was the whole of what lay
+  // under its own op. **WHAT IT IS:** under the amended scope an entry `E` is in scope iff `op.address` is
+  // a prefix of `E.address` **AND** `E.seq` >= the named op's own `seq` (`A: docs/specs/storeroom-native/
+  // write-and-read.md §6.4` item 1's `M-5` amendment and item 3's `M-7` amendment, both 2026-10-16;
+  // `A: docs/decisions.md` · the architect's rulings *"Add temporal stop to the rollback."* and
+  // *"Overshoot is a defect."*), so the store's own walk **STOPS AT THE NAMED OP** — this composition
+  // passes ops in reverse creation order, so an op it has already passed is OLDER than every op a later
+  // call names, is IN THE ADDRESSED SUBTREE AND OUT OF SCOPE, and the store does NOT report it undone by
+  // that later call. The skip's premise is therefore void exactly there, and a still-owed op whose `opId`
+  // stands in no earlier `undoneOps` member **GETS ITS OWN CALL.**
+  //
+  // **THE RULE ABOVE THIS LINE IS UNCHANGED AND SO IS ITS OBSERVABLE — WHICH IS WHAT THE AMENDED CLAUSE
+  // DECLARES AT ITS OWN SITE** (`composition-and-states.md §2.6` item 5 (a)'s 2026-10-16 mark: *"a call's
+  // totality is TOTAL OVER THE TEMPORALLY BOUNDED SET and never over the whole addressed subtree"*, and
+  // *"the kernel still reads only the returned `undoneOps` member and still reasons about no mark"*): the
+  // kernel derives NOTHING from a cross-call premise below. The guard reads the step index `i` instead of
+  // `op.opId` for the ONE reason the two differ and this file's own work loop needs them to: a composition
+  // may in principle receive one `opId` twice (every arm this unit drives holds unique ids), and step `i`
+  // is the step a call over the `i`-th member ISSUED — the op's own id is what the store was NAMED, never
+  // which member it was. **NO CLAUSE MOVES WITH IT: the step count stays the calls ISSUED, `failed` stays
+  // that call's own answer, no mark is consulted and the walk still stops at the failing call.**
   const performed = [];
+  const recorded = [];
   let floor = null;
-  for (const op of callList) {
-    const owed = !performed.includes(op.opId);
+  for (let i = 0; i < callList.length; i += 1) {
+    const op = callList[i];
     // (2) THE SKIP: an op an earlier returned call's own `undoneOps` already reports undone is not still
-    // owed, so NO call is issued over it and no step stands for it (item 5 (a)).
-    if (!owed) continue;
+    // owed, so NO call is issued over it and no step stands for it (item 5 (a)) — and under the amended
+    // scope that is the WHOLE of it: absence from the member is evidence of nothing beyond the store's own
+    // performed set, so an op the member does not name GETS ITS OWN CALL.
+    if (recorded.includes(i)) continue;
     let answer = 'ok';
     let failed = false;
     let record = null;
@@ -1273,6 +1691,11 @@ function composeRollback(kernel, attempt) {
     });
     for (const undone of undoneOps) {
       if (!performed.includes(undone)) performed.push(undone);
+      // THE STEPS THAT ARE ALREADY — RECORDED BY THE MEMBER'S OWN NAMES, WHICH IS THE PREDICATE'S ONE
+      // SOURCE (`item 5 (a)`, unmoved): an op this member names is one this composition has performed.
+      for (let at = i + 1; at < callList.length; at += 1) {
+        if (callList[at].opId === undone && !recorded.includes(at)) recorded.push(at);
+      }
     }
     // AND THE WALK STOPS AT THE FAILING CALL: a call that met either floor code is the composition's
     // LAST — "the walk STOPS at the failing call" (`§2.6` item 6 (a); `fail-surface.md §2`'s `KC-8`