provident-storeroom 0.4.0 → 0.5.0

package/index.d.ts

@@ -22,6 +22,18 @@
 // clause of that date, the crossing form's ONE home; **the ONE figure that moves is the arity, and
 // `storeCreate` remains the namespace's one name and the product its twelve own members**).
 //
+// **⟶ AND THE MEMBER-SET FIGURE ABOVE IS SUPERSEDED AND IS READ THROUGH THIS CLAUSE, 2026-10-17: THE
+// OPERATIVE SET IS THIRTEEN OWN MEMBERS, `10 + 1 + 1 + 1 = 13` ✓, THE THIRTEENTH BEING `constraints()`** —
+// the registered-pair read, declared at `surface.md §2.4` item 9 (f)'s `constraints` clause of that date and
+// at `§2.12` item 2-bis, on the architect's ruling verbatim *"Add surface methods for reading registered
+// constraints."* **THE BYTES ABOVE STAND AS THE `A127` PASS'S READING (`DEF-2026-10-02`: no whole-file
+// rewrite) and every "twelve own members" figure in this file is read through this sentence as THIRTEEN.**
+// **SO A DECLARATION FILE THAT STILL READS TWELVE OWN MEMBERS AFTER THAT DATE IS A FINDING** (`surface.md
+// §2.4` item 9 (f)'s item 10, which names the declaration file among the cells that go red; item 13; its own
+// mark at `§2.9` item 1). **THE TWO ROUTES THAT WOULD HAVE MOVED THE SET EARLIER ARE STILL REFUSED BY NAME
+// AND THIS ONE IS NOT ONE OF THEM** (`§2.5`'s clause of 2026-10-16: a `constraintLog(commit)` reader and a
+// second module-namespace name) — and the second `1` above is `settle`, the third `1` being `constraints`.
+//
 // **THE TEN METHODS TAKE THE RECEIVER'S OWN POSITION AWAY: `8 → 1` ✓ AND `4 → 12` ✓** (`surface.md §2.9`
 // item 1's and `§2.4` item 9 (f)'s `A127` clauses). The seven verbs that reach the store are METHODS of the
 // object `storeCreate` returned, so **NO DECLARED SIGNATURE CARRIES A LEADING `instance` POSITION** — the
@@ -375,7 +387,9 @@ export interface CommitRecord {
  *
  * **THE STATE IS PRIVATE AND NONE OF THE TWELVE IS A RELEASE VERB** (`surface.md §2.1` (e) item 1; `A74`):
  * the instance's own state is released with the instance and by nothing else — no `dispose()`, no `close()`
- * and no finalizer is declared here.
+ * and no finalizer is declared here. **⟶ AND `"THE TWELVE"` READS AS `THIRTEEN` FROM 2026-10-17, the
+ * thirteenth being `constraints()`** (this interface's own clause for it below; the file's header carries the
+ * member-set mark and the two still-refused routes).
  */
 export interface StoreInstance {
   /**
@@ -545,6 +559,66 @@ export interface StoreInstance {
    * `storeCreate`'s own product alone.
    */
   settle(record: CommitRecord): void;
+  /**
+   * **THE REGISTERED-PAIR READ — `constraints() -> ConstraintPair[]`** (`surface.md §2.4` item 9 (f)'s
+   * `constraints` clause of 2026-10-17, items 2–9; `§2.12` item 2-bis; `parameter-semantics.md §2.27` =
+   * `PAR-JS-27`) — **the THIRTEENTH own member** (`10 + 1 + 1 + 1 = 13` ✓, the third `1` being this member),
+   * added on the architect's ruling of that date, verbatim: *"Add surface methods for reading registered
+   * constraints."*
+   *
+   * **THE RECEIVER IS THE STORE, THE CALL TAKES NO ARGUMENT (arity `0`) AND IT THROWS NOTHING**: there is no
+   * outside argument for the class test to refuse, and the call makes NO STORE CALL, MINTS NO CODE, APPENDS
+   * NO JOURNAL ENTRY AND CHANGES NO NODE — so this member is one of the product's NON-STORE-REACHING members
+   * beside `register` and `settle`, and `§2.4` item 9 (f)'s rule (ii) has no subject at it.
+   *
+   * **WHAT IS RETURNED, EXACTLY — THE PAIRS AND NOT THE FUNCTIONS:** a **FRESH JS ARRAY on every call**,
+   * whose **every element is a FRESH plain object carrying EXACTLY TWO MEMBERS** — `address` (a fresh array of
+   * the store's own segments) and `id` (the constraint's own BARE `id`, a `string`) — the same two data the
+   * kernel's own registry is keyed by. **The empty array `[]` is the declared value where the instance carries
+   * no pair at all** (`PAR-JS-27`'s `domain` cell).
+   *
+   * **THE FOUR DECLARED EXCLUSIONS, EACH STATED SO A DECLARATION THAT VIOLATED ONE WOULD BE VISIBLE AT ITS OWN
+   * BYTES:**
+   * 1. **NO CONSTRAINT FUNCTION IS RETURNED** (item 3, four named grounds — the operative one being the
+   *    anti-pattern rulings' *do not hand out a value whose later use the contract cannot bound*). The
+   *    `Constraint` type below is that function and **NO MEMBER OF THIS RETURN CARRIES ONE**; a disabled pair
+   *    makes the hazard sharp, since `constraintOff` parks a stub in the kernel while the caller's function is
+   *    kept in the entry.
+   * 2. **NO OPAQUE IDENTITY IS EXPOSED** (item 4): `ConstraintIdentity` is NOT reachable through this return —
+   *    `PAR-JS-25`'s opacity would break the moment a consumer read one out of the array. **The pair is the
+   *    caller's own datum; the identity is this unit's opaque handle for it, and the two are NOT the same
+   *    datum.**
+   * 3. **NO ORDER IS PROMISED** (item 6): the returned array's order is **UNDECLARED** and a consumer compares
+   *    the pairs **as a SET and never as a sequence** (`DD-22`; `§2.7` item 3). **Nothing in this declaration
+   *    may be read as a registration order, an address order or a `seq`-like ordinal.**
+   * 4. **A DISABLED PAIR DOES APPEAR** (item 5): `constraintOff` is a TOGGLE and NOT A REMOVAL, so a pair it
+   *    disabled is STILL REGISTERED and still enumerated — **and therefore there is NO `enabled` member on an
+   *    element and NO way to read a pair's state off this return**; the state is read at the toggles' own
+   *    clauses. **No removal route exists**, so an absence here means nothing was ever registered.
+   *
+   * **THE COVERAGE, BOTH POPULATION ROUTES ON ONE FOOTING** (item 7): a pair the batch registered at
+   * `storeCreate` (`cfg.constraints`) and a pair `addConstraint` registered appear alike, because *"the entry
+   * carries a pair if and only if a function stands registered at that pair in the kernel's own pair-keyed
+   * registry"*. **The two declared exclusions are therefore structural**: a well-formed `cfg.constraints`
+   * element that carried no function is **not** a carried pair and does not appear, and a REFUSED
+   * registration — at the batch loop or at `addConstraint` — leaves the entry exactly as it stood and does not
+   * appear. **An overwrite changes no membership**: a second `addConstraint` at a held pair replaces the
+   * function at the SAME pair and returns the SAME identity, so the pair is carried ONCE before and after.
+   *
+   * **IT ADDS NO POPULATION ROUTE** (`§2.12` item 2-bis): the two routes stand at TWO, and a read closes none
+   * and opens none. **It is NOT a `pending()` reader, NOT an `attempts()` enumerator and NOT a live view of a
+   * running commit**; it announces no identity, no function and no order.
+   *
+   * **AND IT MOVES NO OTHER FIGURE**: the module namespace keeps its ONE name `storeCreate` (`§2.9` item 1's
+   * `A127` clause, `11 → 1` ✓), the kernel's extent stays FIVE with no `K-6` proposed (`§2.4` item 9 (f),
+   * item 8 — the pairs are read from the entry's OWN registry, which is keyed exactly as the kernel's is), the
+   * store's closed `16`-member set is not reached, the kernel's `KC` set stands closed at `8`, and the register
+   * keeps its `8` rows.
+   *
+   * **It is NOT a named export of this entry** (`package.md §1.3` item 3): it is reached through
+   * `storeCreate`'s own product alone.
+   */
+  constraints(): ConstraintPair[];
 }
 
 /**
@@ -565,6 +639,15 @@ export function storeCreate(cfg: StoreConfig): StoreInstance;
  * `string`** — **and NOT the whole of a batch element**, which is this pair PLUS its constraint function.
  * **Every outside form of the pair throws the three methods' one `TypeError`**, and **a well-formed pair
  * the entry does not carry is outside the two toggles' domain**: it is NOT a third population route.
+ *
+ * **⟶ AND THIS SHAPE IS ALSO THE ELEMENT OF THE FOURTH MEMBER'S RETURN, ADDED 2026-10-17**
+ * (`surface.md §2.4` item 9 (f)'s `constraints` clause; `parameter-semantics.md §2.27` = `PAR-JS-27`,
+ * `return-field`): `a.constraints()`'s every element carries **exactly these TWO members and no third** —
+ * the `address` a pair was registered under and its bare `id` — **and NEITHER the constraint function nor the
+ * opaque identity** (`PAR-JS-25`'s opacity, unmoved). **THE TWO ROLES ARE ONE SHAPE AND NOT TWO**: this is the
+ * caller's own datum entering at `addConstraint` (and at `cfg.constraints`' elements, which are this pair
+ * PLUS a `constraint`) and coming back out at the read. **`Row 27`'s `alt` cell refuses an `enabled` member on
+ * the element**, so no third member is declared here and this interface is left exactly as it stood.
  */
 export interface ConstraintPair {
   readonly address: Address;

package/index.mjs

@@ -1997,6 +1997,16 @@ export function storeCreate(cfg) {
     constraintOff(pair, constraint) {
       return constraintToggle(false, instance, arguments.length, pair, constraint);
     },
+    /// **`surface.md §2.4` item 9 (f)'s `constraints` clause of 2026-10-17: `a.constraints() -> Array<{ address,
+    /// id }>` — THE REGISTERED-PAIR READ, the thirteenth own member (`10 + 1 + 1 + 1 = 13` ✓; `PAR-JS-27`;
+    /// `§2.12` item 2-bis).** **THE RECEIVER IS THE STORE, THE CALL TAKES NO ARGUMENT (arity `0`) AND IT
+    /// THROWS NOTHING** — there is no outside argument for the class test to refuse, and the call makes no
+    /// store call, mints no code, appends no journal entry and changes no node. **It is NOT a named export of
+    /// the entry** (`package.md §1.3` item 3; `§2.9` item 1's `A127` clause, `11 → 1` ✓): it is reached
+    /// through the factory's own product alone.
+    constraints() {
+      return enumerateConstraints(state);
+    },
     /// `surface.md §2.4` item 5 (b): `register(handle, listener) -> undefined` — the OPAQUE handle a verb
     /// returned or the construction adopted, and ANY JS function. **It is NOT a named export of the entry**
     /// (`package.md §1.3` item 3): it is reached through the factory's own product alone.
@@ -3150,6 +3160,55 @@ function constraintToggle(enabled, instance, n, pair, constraint) {
   return undefined;
 }
 
+/// **THE REGISTERED-PAIR READ — `surface.md §2.4` item 9 (f)'s `constraints` clause of 2026-10-17, items 2–8,
+/// AND ITS REGISTER ROW `PAR-JS-27` (`parameter-semantics.md §2.27`).** `a.constraints() -> Array<{ address,
+/// id }>`: **a FRESH JS ARRAY on every call, whose every element is a FRESH PLAIN OBJECT carrying EXACTLY
+/// TWO MEMBERS** — `address`, a FRESH JS array of the store's own segments, and `id`, the constraint's own
+/// BARE `id`, a `string` — the same two data the kernel's own registry is keyed by.
+///
+/// **THE SOURCE IS THE ENTRY'S OWN `state.constraints`, AND ITS SHAPE IS ALREADY THE ANSWER'S**: a per-instance
+/// `Map` keyed by `constraintPairKey(address, id)` whose every value is the record `carryConstraint` writes —
+/// `{ address, addressKey, id, fn, enabled, identity }`. So the read is a CARRIAGE READ and no kernel item is
+/// touched or minted: `K-1`–`K-5` stand exactly as printed, the kernel's extent stays FIVE and no `K-6` is
+/// proposed (`§2.4` item 9 (f), item 8). **NO KERNEL MODULE IS EVEN LOADED HERE** — `constraintsKernel()` is
+/// not called, so a product that never carried and never asked for a constraint still reads `[]` on a tree
+/// that stages nothing beside it (`kernel-surface.md §1` item 1's lazy resolution).
+///
+/// **THE FOUR DECLARED EXCLUSIONS, EACH HONOURED AT THIS SITE AND NAMED HERE SO THE CODE CAN BE READ AGAINST
+/// THEM:**
+/// * **(1) NO CONSTRAINT FUNCTION IS RETURNED** (item 3, four grounds, the operative one for this frame being
+///   the anti-pattern rulings: *do not hand out a value whose later use the contract cannot bound*). The
+///   element is BUILT FRESH from `entry.address` and `entry.id`, so `entry.fn` is never read, referenced or
+///   copied — and a disabled pair's parked stub is not reachable either, because a function is never touched
+///   at all.
+/// * **(2) NO OPAQUE IDENTITY IS EXPOSED** (item 4; `PAR-JS-25`'s opacity would break the moment a consumer
+///   read one out of the array). `entry.identity` is not read and no element carries it.
+/// * **(3) NO ORDER IS PROMISED, AND NONE IS MANUFACTURED** (item 6): the enumeration is `Map` iteration order
+///   and nothing else — **this function does NOT sort, and deliberately does not** — so a drive compares the
+///   pairs as a SET and never as a sequence (`DD-22`; `§2.7` item 3). No registration order, address order or
+///   `seq`-like ordinal is minted here, and none is asserted of it.
+/// * **(4) A DISABLED PAIR DOES APPEAR** (item 5): `constraintOff` is a TOGGLE and NOT A REMOVAL, so a pair
+///   whose `entry.enabled` is `false` is STILL CARRIED and is enumerated — **the read does not consult
+///   `enabled` at all**, and it returns no `enabled` member either (a third member is a value no clause
+///   declares).
+///
+/// **AND THE TWO EXCLUSIONS ITEM 7 DECLARES ARE STRUCTURES AND NOT TESTS TAKEN HERE**: (i) a well-formed
+/// `cfg.constraints` element that carried no function never reached `carryConstraint` (`storeCreate`'s batch
+/// loop skips it), so it is no entry and cannot appear; and (ii) a refused registration wrote no entry
+/// (`carryConstraint`: *"THE ENTRY'S OWN RECORD IS WRITTEN ONLY WHERE THE REGISTRATION STOOD"*), so it
+/// cannot appear either. **THE SAME TWO MEMBERS ON EVERY ELEMENT AND NO THIRD**, and the `[]` arm is this
+/// member's declared value where the entry carries no pair at all (`PAR-JS-27`'s `domain` cell).
+function enumerateConstraints(state) {
+  const pairs = [];
+  for (const entry of state.constraints.values()) {
+    // A FRESH PLAIN OBJECT PER CALL AND A FRESH SEGMENT ARRAY WITHIN IT (`slice`): a caller that mutates a
+    // returned element, or an element's `address`, changes nothing the next call returns — and nothing of the
+    // entry's own record either, the two members being copies of the pair's own data.
+    pairs.push({ address: entry.address.slice(), id: entry.id });
+  }
+  return pairs;
+}
+
 /// **WHETHER THIS INSTANCE CARRIES A PAIR AT THIS WRITE'S ADDRESS** (`§2.12` item 1's preamble clause (a)) —
 /// the gate stage 1 takes before the kernel is reached at all. **THE CLASS DECISION COMES FIRST AND NO TRAP
 /// IS RUN ON ANY PATH** (`DD-34`): a `Proxy` address, a class extending `Array` and every non-array lies

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -38,11 +38,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.4.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.4.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "0.4.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "0.4.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.4.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "0.5.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "0.5.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "0.5.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "0.5.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "0.5.0"
   },
   "publishConfig": {
     "access": "public"

package/src/constraint-kernel.mjs

@@ -1625,13 +1625,43 @@ function composeRollback(kernel, attempt) {
   callList.reverse();
   // THE REVERSALS EARLIER RETURNED CALLS PERFORMED — the store's own reports, the only member item 5's
   // "still owes" predicate (and item 5 (a)'s skip) is decided by.
+  //
+  // ⟶ AND THE PREDICATE IS THE MEMBER ALONE, READ AGAINST THE SET IT NAMES — CORRECTED 2026-10-17, AT THE
+  // TEMPORAL-STOP AMENDMENT, AND THE CORRECTION IS NAMED WITH WHAT IT WAS AND WHAT IT IS BECAUSE THIS IS
+  // THE ONE KERNEL EDIT THE AMENDMENT OWES. **WHAT IT WAS:** the guard below was
+  // `!performed.includes(op.opId)`, which is the same reading ONLY WHILE THE STORE'S PER-OP REACH WAS
+  // TOTAL OVER THE WHOLE ADDRESSED SUBTREE — under that reach an op's ABSENCE from every earlier
+  // `undoneOps` member proved a call still owed it, because a call's `undoneOps` was the whole of what lay
+  // under its own op. **WHAT IT IS:** under the amended scope an entry `E` is in scope iff `op.address` is
+  // a prefix of `E.address` **AND** `E.seq` >= the named op's own `seq` (`A: docs/specs/storeroom-native/
+  // write-and-read.md §6.4` item 1's `M-5` amendment and item 3's `M-7` amendment, both 2026-10-16;
+  // `A: docs/decisions.md` · the architect's rulings *"Add temporal stop to the rollback."* and
+  // *"Overshoot is a defect."*), so the store's own walk **STOPS AT THE NAMED OP** — this composition
+  // passes ops in reverse creation order, so an op it has already passed is OLDER than every op a later
+  // call names, is IN THE ADDRESSED SUBTREE AND OUT OF SCOPE, and the store does NOT report it undone by
+  // that later call. The skip's premise is therefore void exactly there, and a still-owed op whose `opId`
+  // stands in no earlier `undoneOps` member **GETS ITS OWN CALL.**
+  //
+  // **THE RULE ABOVE THIS LINE IS UNCHANGED AND SO IS ITS OBSERVABLE — WHICH IS WHAT THE AMENDED CLAUSE
+  // DECLARES AT ITS OWN SITE** (`composition-and-states.md §2.6` item 5 (a)'s 2026-10-16 mark: *"a call's
+  // totality is TOTAL OVER THE TEMPORALLY BOUNDED SET and never over the whole addressed subtree"*, and
+  // *"the kernel still reads only the returned `undoneOps` member and still reasons about no mark"*): the
+  // kernel derives NOTHING from a cross-call premise below. The guard reads the step index `i` instead of
+  // `op.opId` for the ONE reason the two differ and this file's own work loop needs them to: a composition
+  // may in principle receive one `opId` twice (every arm this unit drives holds unique ids), and step `i`
+  // is the step a call over the `i`-th member ISSUED — the op's own id is what the store was NAMED, never
+  // which member it was. **NO CLAUSE MOVES WITH IT: the step count stays the calls ISSUED, `failed` stays
+  // that call's own answer, no mark is consulted and the walk still stops at the failing call.**
   const performed = [];
+  const recorded = [];
   let floor = null;
-  for (const op of callList) {
-    const owed = !performed.includes(op.opId);
+  for (let i = 0; i < callList.length; i += 1) {
+    const op = callList[i];
     // (2) THE SKIP: an op an earlier returned call's own `undoneOps` already reports undone is not still
-    // owed, so NO call is issued over it and no step stands for it (item 5 (a)).
-    if (!owed) continue;
+    // owed, so NO call is issued over it and no step stands for it (item 5 (a)) — and under the amended
+    // scope that is the WHOLE of it: absence from the member is evidence of nothing beyond the store's own
+    // performed set, so an op the member does not name GETS ITS OWN CALL.
+    if (recorded.includes(i)) continue;
     let answer = 'ok';
     let failed = false;
     let record = null;
@@ -1661,6 +1691,11 @@ function composeRollback(kernel, attempt) {
     });
     for (const undone of undoneOps) {
       if (!performed.includes(undone)) performed.push(undone);
+      // THE STEPS THAT ARE ALREADY — RECORDED BY THE MEMBER'S OWN NAMES, WHICH IS THE PREDICATE'S ONE
+      // SOURCE (`item 5 (a)`, unmoved): an op this member names is one this composition has performed.
+      for (let at = i + 1; at < callList.length; at += 1) {
+        if (callList[at].opId === undone && !recorded.includes(at)) recorded.push(at);
+      }
     }
     // AND THE WALK STOPS AT THE FAILING CALL: a call that met either floor code is the composition's
     // LAST — "the walk STOPS at the failing call" (`§2.6` item 6 (a); `fail-surface.md §2`'s `KC-8`