provident-storeroom 1.0.1 → 1.1.0

package/README.guide.md

@@ -30,6 +30,32 @@ pins, `§8.1`'s *"an installed `0.5.0`"*, and `§11`'s manifest table.** **AND T
 IS UNMOVED: no `npm install` was run against the registry, so a registry-installed `1.0.0` is described here from
 the manifest and from measurements on this checkout, and is still not witnessed.**
 
+**⟶ AND THE FIGURE THAT CORRECTION CARRIES IS ITSELF ONE RELEASE BEHIND, 2026-10-27 — THE VERSION THIS GUIDE
+DESCRIBES IS `1.0.1`, AND EVERY `1.0.0` THIS GUIDE PRINTS READS `1.0.1` FROM HERE ON.** `RCA-8(g)`
+ANNOTATE-BESIDE: **the paragraph above stands BYTE-FOR-BYTE and is read THROUGH this clause — so do its reading of
+`0.5.0` and its reading of `1.0.0`; each was true of the tree it was read on and each is one release behind the
+shipped tree from this date.** **THE MANIFEST AT ITS OWN BYTES: `bindings/js/package.json`'s `version` is
+`"1.0.1"`, and all five `optionalDependencies` pins are `1.0.1` with it** — the six figures move together and never
+singly (§0 item 1; `PUB-DD-10`) — **and the tags the tree carries are `v1.0.0` and `v1.0.1`, with `main` sixteen
+commits past `v1.0.1` and no version bump in any of them** (`git describe` at this date reads `v1.0.1-16-gdf3ef88`;
+`D-41` item `1`'s semver ruling names the next release `1.1.0`, and that release has not been cut). **SO THE SITES
+ARE RE-READ, NOT RE-SPELLED:** §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to
+`1.0.0` — and §11's manifest table all read `1.0.1`; **every `0.5.0` this guide prints is the figure of its writing
+date and reads `1.0.1` from here on.** **AND THE ONE THING NO PASS WITNESSED IS STILL UNMOVED: no `npm install` was
+run against the registry, so a registry-installed `1.0.1` is described here from the manifest and from
+measurements on a locally packed, installed artefact, and is still not witnessed as a registry download.**
+
+**AND ONE THING A READER OF THE INSTALLED PACKAGE SHOULD KNOW BEFORE THE CITATIONS: WHEN THIS DOCUMENT IS AT
+`node_modules/provident-storeroom/README.guide.md`, IT IS THIS GUIDE.** **Its ONE authored home is
+`docs/guides/package-use.md` in the repository, and the release's assembly stages it byte-for-byte at the packaging
+root as `README.guide.md`, beside `README.md`, where the manifest's `files` row ships it** (`PUB-DD-11`;
+`docs/specs/storeroom-publish/contract.md §2.3` item `3`; `scripts/publish.sh`'s guide stage). **The paths this guide
+cites — `bindings/js/…`, `docs/specs/…`, `tests/…` — are the CHECKOUT's, and they do not travel in the tarball; a
+consumer reading from `node_modules` has this guide's text and the package's own shipped bytes (`index.mjs`,
+`index.d.ts`, `README.md`, `src/`), and every declaration a citation names is answered first by those bytes.** **So
+nothing here is addressed to a checkout reader alone: the installed tree carries this text unaltered, and a clause
+that names a repository path says where its authority lives, not where you must stand to use it.**
+
 **Every figure carries one of four marks, and the four are not the same thing:**
 
 | the mark | what it means |
@@ -156,6 +182,13 @@ range, all six figures moving together (§0 item 1; `PUB-DD-10`).** **`1.0.0` is
 §11), so the main `version` and the five pins are one figure and a consumer who reads a `0.5.0` anywhere in a
 manifest has the wrong package.**
 
+**⟶ AND THE FIGURE MOVES AGAIN, 2026-10-27: each of the five is pinned to `1.0.1`, not `1.0.0`**
+(`bindings/js/package.json`, read at its own bytes; §0's correction of this date; `RCA-8(g)` ANNOTATE-BESIDE — the
+two clauses above stand and are read THROUGH this one). **THE READING THEY TEACH IS UNMOVED AND IS THE POINT: five
+EXACT pins, no caret, no tilde and no range, all six figures moving together (§0 item 1; `PUB-DD-10`) — so `1.0.1`
+is the package's own version and the five pins' one figure, and a consumer who reads anything else in a manifest
+has the wrong package.**
+
 ### §2.3 The three rungs
 
 1. **RUNG ONE — the scoped platform package for this runtime's `process.platform` × `process.arch` key.** This is
@@ -756,6 +789,11 @@ BYTE and is read THROUGH this clause). **(i) *"The store implements seventeen (`
 NINETEEN**: `src/error.rs`'s `CODES` is `[&str; 19]`, ranks `18` and `19` being the two this set's 2026-10-26 ruling
 appended — **so the declaration of record and the crate agree at nineteen, which is the row above.** **(ii)
 *"installed `0.5.0`"* READS `1.0.0`** (`bindings/js/package.json`, read at its own bytes; §0's correction clause).
+
+**⟶ AND THAT CORRECTED FIGURE IS ITSELF ONE RELEASE BEHIND, 2026-10-27: *"installed `0.5.0`"* READS `1.0.1`**
+(`bindings/js/package.json` at its own bytes; §0's correction of this date; `RCA-8(g)` ANNOTATE-BESIDE — the
+sentence above stands and is read THROUGH this one). **THE SENTENCE'S OWN POINT IS UNMOVED: the escape arm is what
+keeps a member the set has since gained typeable in an installed copy, and the set is the store's to close.**
 **(iii) THE SET HAS NOW MOVED FOUR TIMES, NOT THREE**: fourteen to fifteen, fifteen to sixteen, sixteen to
 seventeen, **and seventeen to nineteen** — **the escape arm's argument is strengthened rather than weakened by the
 fourth move, which is exactly the arm's own evidence.** **NO TABLE ROW, NO RANK AND NO TRIGGER MOVES, and the two
@@ -876,6 +914,21 @@ defect** (`DD-28`; `native/contract.md §7.2` item 6; `write-and-read.md §4.3`'
 **What this means for you, in one line: durability is a property of `file`-tier WRITES. If you delete something
 durable and the process then restarts, expect it back — and delete it again after the boot, or write over it.**
 
+**⟶ AND THE SENTENCE ABOUT THE BYTES IS ONE PRODUCER SHORT, 2026-10-27 — A REFUSED REVERSAL'S RESTORE NOW WRITES
+THEM WHERE IT MOVED A `file`-TIER NODE (`bd0fd8c`).** `RCA-8(g)` ANNOTATE-BESIDE: **the section above stands
+BYTE-FOR-BYTE and is read THROUGH this clause; THIS clause is a PURE INSERTION and moves no verb, no tier, no status
+and no record.** **WHAT MOVED: the restore a REFUSED `rollback` performs — the compensating act that puts the state
+back before the reversal — takes the `file` tier's projection before it and again after it, and where a version
+standing at `Tier::File` moved it SAVES the restored image with the store's one writer.** **SO THE BYTES AT
+`filePath` ARE THE LAST SUCCESSFUL SAVE'S, whose producers are a `file`-tier `write`'s commit AND a restore that moved
+a file-tier node** — and **`and no other state` stands whole: the boot reads the register image at the file tier and
+nothing else** (`native/contract.md §6.6` item `5`'s clause of 2026-10-27, the declaration's one home; `DD-28`'s
+amended cell). **WHAT DOES NOT MOVE, SAID SO THE READING IS NOT TAKEN WIDER THAN IT IS:** **a `delete` still performs
+no file I/O and a SUCCESSFUL `rollback` still performs none either**, so the paragraph above holds for both — the
+removed version still stands again after the re-boot; **the save is the REFUSED arm's alone, it appends no journal
+entry (a save is an effect and not an op), and a save that cannot land is reported (`FileCommitFailed`, the
+in-memory state restored and the bytes not updated) rather than swallowed.**
+
 ### §9.4 When the save itself fails
 
 **On a `file`-tier write's save that fails — the act itself failing, not a constraint — the store rolls the write
@@ -1016,6 +1069,24 @@ contract.**
 clause). **`name`, `type`, `license`, `engines`, `exports` and `files` are UNMOVED and were re-read at the same
 bytes; the five `files` rows are still a fact of this tree and not a rule (the ★ paragraph below).**
 
+**⟶ AND THE TWO FIGURES THAT CLAUSE CORRECTS MOVE AGAIN, 2026-10-27: `version` is `1.0.1` and each of the five
+`optionalDependencies` is pinned to `1.0.1`** (`bindings/js/package.json`, read at its own bytes; §0's correction of
+this date; `RCA-8(g)` ANNOTATE-BESIDE — the table and the correction above stand and are read THROUGH this clause).
+**AND THE `files` ROW'S OWN FIGURE IS RE-READ AT ITS OWN SITE IN THE CLAUSE BELOW: it reads SIX rows, the sixth
+being the consumer guide's landed copy, `README.guide.md`.**
+
+**⟶ AND THE FIVE FIGURES THIS GUIDE PRINTS ABOUT THE SHIPPED TREE ARE RE-MEASURED AT IT ON ONE DATE, 2026-10-27, SO
+THE GUIDE IS NOT LEFT ONE TREE BEHIND ANY OF THEM.** `RCA-8(g)` ANNOTATE-BESIDE: **every table row, every ★
+paragraph and every figure above stands BYTE-FOR-BYTE and is read THROUGH this clause; THIS clause adds no rule and
+moves no figure — it records, at one date, the reading of each figure the guide states about the shipped tree, and
+each is the figure its own clause already prints.** **THE FIVE, EACH WITH ITS MEASUREMENT:**
+1. **THE STATUS SET IS TWENTY** — `src/error.rs`'s `CODES` is `[&str; 20]`, ranks `1`…`20`, and the declaration of record (`index.d.ts`, `StoreStatus`) agrees with the crate at twenty (§8.1's heading, its table's `20` row and its dated clauses).
+2. **THE PACKED MEMBER SET IS NINETEEN BARE AND TWENTY ASSEMBLED** — measured with `npm pack --json` at `bindings/js`: the BARE tarball carries `19` paths (`1` `package.json` + `4` root files — `README.guide.md` among them + `13` entry modules + `1` kernel: `1 + 4 + 13 + 1 = 19` ✓), and the ASSEMBLED tarball — the same stage with the release's `LICENSE` copy — carries `20`, the nineteen plus the licence (the ★ re-read clause (ii) below; the installed battery's `INSTALL-01` prints `members=20` on every run).
+3. **THE ALLOWLIST IS SIX ROWS** — `bindings/js/package.json`'s `files` reads `index.mjs` · `README.md` · `README.guide.md` · `index.d.ts` · `src/entry/` · `src/constraint-kernel.mjs` (`6 = 4 + 2` ✓) — **and `README.guide.md` is THIS document's landed copy** (§0's clause on the landing; the ★ re-read clause (i) below).
+4. **THE INSTANCE CARRIES FOURTEEN OWN MEMBERS** — measured on an instance built in memory from the shipped artefact: `Object.keys` and `Object.getOwnPropertyNames` are both the same fourteen-name list, and `read`'s own descriptor reads `writable: true, enumerable: true, configurable: true` (§3's table; §3.1).
+5. **THE DEPTH CEILING IS `126`** — the crossing's guard reads `depth > 126` (`bindings/js/src/crossing.rs`), so a value of depth `126` is admitted and one of depth `127` is refused; the node ceiling stands at `1,000,000` beside it (`json-crossing/contract.md §4`'s clause; §10.4).
+**NO FIGURE MOVES BY THIS CLAUSE, AND THE ONE THING IT ADDS IS THE DATE ON WHICH ALL FIVE WERE READ AT THE SAME TREE.**
+
 **★ THE `exports` MAP HAS ONE ARM, AND THAT IS A PROMISE ABOUT WHAT IS REACHABLE:** **the addon is NOT reachable
 as a subpath and neither is the constraint kernel.** **There is no wildcard export, no deep import to the addon
 and no CJS arm** (`bindings/js/README.md`; `docs/specs/storeroom-publish/contract.md §1.3`;
@@ -1202,6 +1273,21 @@ that a read-back's prototype is or is not a particular object.** **What IS decla
 tree sharing no mutable member with the store or with another crossing**, which is the guarantee worth relying on
 (`json-crossing/contract.md §5`, item (3)(c)).
 
+### §12.6b The two known fail-states, and how you leave them
+
+**⟶ ADDED `1.1.0` — THIS IS THE ONE PART OF THE PROMISE A CONSUMER READING ONLY `node_modules` HAD NOWHERE TO FIND, AND IT SHIPS HERE BECAUSE THIS DOCUMENT SHIPS.**
+
+**Two windows in the constraint machinery are known and are NOT defects. Each is a state you can leave.**
+
+1. **A `delete`'s listener delivery.** A listener invoked by a delete's delivery runs **no constraint pass** — there is no attempt for a pass to run over. **A `rollback` issued from inside it is unjudged, and its effect stands.**
+2. **A registration's own evaluation.** `addConstraint`'s and `constraintRegister`'s evaluation of a supplied body runs **no pass** for the same reason — **an action raised there is unjudged and its effect stands.**
+
+**THE FIRST EXIT — RELOAD THE FILE.** Since `1.1.0`, **a restore that moved a version standing at the `file` tier SAVES the restored image**, so **the file records the state the store was restored to, and a fresh boot over that path returns to judged bytes.**
+
+**THE SECOND EXIT — REGENERATE THE STORE.** Construct a new instance and replay your writes; **a judged state by construction.**
+
+**Neither window is new and neither is a defect**: both are places **a pass does not begin**, not places a judgement was skipped mid-flight. **And every pass that DOES run drains its own restart request** — so the fail-state is bounded by the two acts that run none.
+
 ### §12.7 A skip is not a green, and your own throws are not refusals
 
 **WHAT BREAKS:** **a `skipped` cell is a cell that DID NOT RUN** — *"a skip is not a green"*, in the authority

package/index.d.ts

@@ -465,6 +465,26 @@ export interface DeleteRecord {
   readonly tiers: readonly Tier[];
   /** **THE TRIGGER'S PAIRS** (`contract.md §2.4` item 1; `PAR-HL-38`; `A43` — a delete fires its own set). */
   readonly triggered: readonly TriggerPair[];
+  /**
+   * **THE OP THE `delete` LANDED — THE STORE'S OWN JOURNAL RECORD, `null` WHERE THE ACT REMOVED NOTHING**
+   * (`strata/decisions.md` · `D-43` item 3, the architect, verbatim: *"Delete should be journaled and
+   * reversible"*).
+   *
+   * **IT IS THE MEMBER `WriteRecord` CARRIES, AT THE SAME NAME AND THE SAME TYPE** (`WriteRecord.op` above,
+   * the store's own eight-member `JournalOp`), so a caller has **one spelling for "the op this act landed"**
+   * and one route to reversing it: `store.rollback(record.op.opId)` restores every version the delete
+   * removed, **at its own tier**, exactly as a write's reversal restores what the write replaced.
+   *
+   * **THE MEASURED FACT THIS MEMBER EXISTS FOR.** The delete was already journaled — the store appended one
+   * entry carrying the address, the per-tier before-state and an op id, and `rollback` already accepted that
+   * id — but the record carried no identity, so **the act could not be NAMED, and an act that cannot be
+   * named cannot be reversed**: that is why the kernel's unwinding could not reach a delete's effect at all.
+   *
+   * **AND `null` IS THE `D-3` ARM, SAID PLAINLY.** A delete that removes no version is a **success** with
+   * `tiers: []` (`§4.4` arm `D-3`; `native contract.md §6.5` item 11 adds `triggered: []`) and appends no
+   * journal entry, so there is no op to carry: **nothing is named because nothing was destroyed.**
+   */
+  readonly op: JournalOp | null;
 }
 
 /**
@@ -665,6 +685,16 @@ export interface StoreInstance {
    * call `a.rollback(w.op.opId)`, whose id is the string `write` returned, is a correct call.
    */
   rollback(opId: string): RollbackRecord;
+
+  /**
+   * **⟶ AND IT THROWS: `1.1.0`'S DECLARATION, ADDED BESIDE THE SIGNATURE RATHER THAN IN IT.** **`rollback` was
+   * TOTAL at `1.0.1` — it answered a `RollbackRecord` and could not fail. It is PARTIAL now**: **a reversal the
+   * registered constraints do not admit REFUSES**, throwing the one plain form `{status, message, log}` with
+   * `status: 'ConstraintPassRefused'`, **and the store is restored to the state it stood at before the reversal**
+   * (`D-38`, `D-40`, `D-41`). **A TypeScript signature has no `throws` clause, so this is the honest place to say
+   * it**: *the return type describes what a call returns when it returns, and the throw is part of the contract.*
+   * **A lawful reversal is unchanged** — same record, same members, no `log`. **Callers on `1.0.1` must handle it.**
+   */
   /**
    * Begin watching the addresses the caller names under the caller's own handle.
    *

package/index.mjs

@@ -312,12 +312,20 @@ export function storeCreate(cfg) {
       // the receiver is known to be one. **NO TOKEN IS MINTED AND NO SECOND FORM IS BUILT** — the entry's own
       // refusal is what answers, reached by handing the receiver on.
       if (!isStoreReceiver(this)) return decodeValue(carryRefusal(() => entryOf().write.call(this), []));
-      // **⟶ `§4.1`: `write` OPENS ONE — AND A KERNEL-DRIVEN WRITE JOINS THE EXTANT RATHER THAN OPENING A
-      // SECOND.** The bracket is taken at this member's OWN opening, so the kernel's four-position leg and a
-      // listener body's nested write both find the count above zero and join it (`openCommit`). **THE
-      // DECREMENT IS ON THE FINAL RETURN TO THE CLIENT** (`closeCommit`), taken in a `finally` so the bracket
-      // is released on every arm — a count left standing after a return is on `§5`'s failure list.
-      const opened = openCommit(instance);
+      // **⟶ `§4.1`: `write` OPENS ONE — UNLESS THE CALL NAMES A COMMIT AT THIS METHOD'S FOURTH POSITION, WHICH
+      // IS THE DISCRIMINATOR `D-46` SETS: A CALL THAT SUPPLIES IT JOINS THE COMMIT IT NAMES, AND A CALL THAT
+      // SUPPLIES NONE OPENS A NEW ONE** (`strata/decisions.md` · `D-46`). **THE POSITION IS READ HERE AND
+      // NOWHERE ELSE**, because this member is the one place a call's own entry names a commit: the kernel's
+      // store leg is a FOUR-position call (`store.write(address, tier, value, record)`, `kernel-commit.mjs`) and
+      // therefore JOINS the commit the caller's three-position write opened, while a caller's plain write, a
+      // listener body's write and a constraint body's write all supply three positions and OPEN — the listener's
+      // being `D-43` item `1`'s *"its own commit"*, reached by declaration rather than by an authorship the
+      // package used to infer. **A SUPPLIED POSITION NAMES A COMMIT WHETHER OR NOT IT IS IN THE POSITION'S CLASS
+      // DOMAIN**: the class test below refuses an outside value before any store act, and a refused write
+      // releases the bracket in the `finally` below like every other arm.
+      // **THE DECREMENT IS ON THE FINAL RETURN TO THE CLIENT** (`closeCommit`), taken in a `finally` so the
+      // bracket is released on every arm — a count left standing after a return is on `§5`'s failure list.
+      const opened = openCommit(instance, arguments.length >= 4 ? commit : undefined);
       try {
       // **⟶ `docs/specs/storeroom-js/surface.md §2.12` ITEM 1, STAGE 1, AMENDED 2026-10-18 — THE ENTRY→KERNEL EDGE IS UNCONDITIONAL: EVERY
       // FOUR-POSITION WRITE ENTERS THE KERNEL'S `K-2`, AND THE `carriesConstraintAt` GATE THIS VERB ONCE TOOK
@@ -457,6 +465,11 @@ export function storeCreate(cfg) {
     /// and the in-domain no-op arm a SUCCESS returning `tiers: []`. **Its declared NAME is `delete`, and it is
     /// published under that name ALONE** (`package.md §1.3` item 3): `deleteOp` is a reserved-word workaround
     /// for the declaration and never a member of the package's namespace.
+    ///
+    /// **⟶ AND IT CARRIES THE DELETE'S OWN `op` FROM 2026-10-27** (`D-43` item 3; `index.d.ts`
+    /// `DeleteRecord.op`): the member `write`'s record carries, at the same name, so `rollback(record.op.opId)`
+    /// reverses the delete. `null` is the `D-3` arm that removed nothing — it appended no entry, so it names
+    /// no op — and it crosses unchanged rather than folding to `undefined` (`crossing.md §1.3`).
     delete(address, tier) {
       // **⟶ `§4.1`: `delete` OPENS ONE.**
       const opened = openCommit(instance);
@@ -471,6 +484,7 @@ export function storeCreate(cfg) {
           address: decodeSegments(answer.address),
           tiers: answer.tiers,
           triggered: crossTriggered(state, answer.triggered),
+          op: answer.op === null ? null : decodeJournalOp(answer.op),
         };
         // `A43`: a delete FIRES its own triggered set, on the same window as a write (`docs/specs/storeroom-js/surface.md §2.7` item 2).
         deliver(state, receipt.triggered, answer.triggeringAddress);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -40,11 +40,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.0.1",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.0.1",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.0.1",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.0.1",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.0.1"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.1.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.1.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.1.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.1.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.1.0"
   },
   "publishConfig": {
     "access": "public"