provident-storeroom 1.0.1 → 1.2.0

package/src/entry/constraints.mjs

@@ -4,19 +4,26 @@ import { appendOwn, fail, refusalLog } from './refusal.mjs';
 import { withAddon, require_ } from './artefact.mjs';
 import { classSpelling, isAdmittedArray, isPlainObjectValue } from './class-decision.mjs';
 import { constraintAddress } from './frame.mjs';
-import { homeAddressKey, isStoreReceiver, openCommits } from './state.mjs';
+import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver, openCommits, closeCommit, openCommit, windowMark } from './state.mjs';
 // **THE KERNEL'S OWN RECORD, FOR ONE FIELD AND ONE ONLY** (`D-46`/`D-30`): `kernelFor(store)` answers the
 // instance's kernel record — the same accessor every kernel act takes the instance through — and
 // `reversalAtRest` below reads that record's own `live` map for the count of OPEN ATTEMPTS. `kernel-foundations`
 // carries NO import of its own (`kernel-surface.md §1` item 1's empty-footprint clause), so this reach adds no
 // load path, no addon call and no store act; it is a FIELD READ of state the instance already owns, taken the
 // way the kernel's four part modules take it.
-import { kernelFor } from './kernel-foundations.mjs';
+//
+// **⟶ AND `append` FROM 2026-10-27 — THE ONE ORDINAL MINTING SITE, TAKEN FOR THE REPORT'S OWN COPY OF THE
+// RESTARTED CHECK'S ENTRY (`carryRestartRefusal`).** The entry that reaches a driver through the closed
+// report is IN THE ATTEMPT'S LOG, whose entries carry `seq` ascending from `1` (`kernel-surface.md §2.5` item
+// 1; `assertLogEntry`'s own member set). The copy is therefore minted by the kernel's own append — the same
+// function the pass appends with — rather than pushed here with a member set of its own; the REFUSAL's own
+// list keeps its five members and no `seq`, because no attempt stands at the judgement that built it
+// (`D-41` item 4). Two records, two honest forms, one append.
+import { append, externalCall, kernelFor } from './kernel-foundations.mjs';
 // **⟶ AND THE CARRIERS, ADDED 2026-10-26 FOR THE REFUSAL'S OWN UNDOING (`DEF-W`'s `(a)`).** The
 // compensating act below reaches the store's own verb at its entry, with the SAME carrier forms every member
 // hands it (`carrier.mjs` is the boundary's one encoder for the three positions and imports nothing of this
 // file, so this reach adds no cycle and no second conversion rule).
-import { encodeAddress, encodeTier, encodeValue } from './carrier.mjs';
 
 // ═══════════════════════════════════════════════════════════════════════════════════════════════════════
 // THE POST-CREATION CONSTRAINT SET — `surface.md §2.12` items 1–5, `A126` (2026-10-16), AND ITS TWO ROUTES
@@ -750,6 +757,15 @@ function carriesConstraintAt(state, address) {
  */
 export function constraintWrite(state, instance, address, tier, value) {
   const kernel = constraintsKernel();
+  // **⟶ THE EPOCH RULE'S FRAME IS GONE WITH THE CONSUMER IT GUARDED, 2026-10-27 — `D-42`'s REQUEST NOW NAMES
+  // THE WINDOW THAT RAISED IT (`state.mjs`'s `currentWindow`), AND `runAttempt`'s drain COMPARES THE TWO
+  // IDENTITIES.** The bytes that stood here were `if (CHECK_DEPTH === 0) clearStaleRestart(instance);` and
+  // `CHECK_DEPTH += 1;`, with a matching clear at the failing arm and a decrement in the `finally`: a stack
+  // depth in THIS frame standing in for *"a request belongs to the act that raised it"* (`D-42` item `3`).
+  // **THEY ARE DELETED, NOT MOVED** — the fact they approximated is now the store's own (a commit identity,
+  // minted with the opening and answered by every joining call), so there is no counting frame to be found in
+  // the wrong place and none to be bypassed by a driver that never reaches this member. **ONE MECHANISM, NOT
+  // TWO.**
   let record;
   try {
     record = kernel.commit(instance, address, tier, value);
@@ -761,8 +777,30 @@ export function constraintWrite(state, instance, address, tier, value) {
   try {
     report = kernel.runAttempt(instance, record);
   } catch (refusal) {
+    // **A FAILING ATTEMPT IS THE TERMINAL CALL'S OWN REFUSAL, AND ITS FLOOR HAS ALREADY PUT THE STORE BACK
+    // TO THE STATE IT FOUND** (`D-40`) — and the restart does not run over a floor-restored state, **NOW BY
+    // CONSTRUCTION RATHER THAN BY THIS FRAME'S CARE**: `runAttempt`'s drain is reached only where its pass
+    // answered a report, and a failing pass throws before the drain (the passing arm alone, `D-42` item
+    // `2`'s own reading, taken structurally). A request the failing pass's bodies raised stands with that
+    // pass's window identity and dies at the next pass's drain — **A FAILING NESTED WRITE's request is in the
+    // ENCLOSING window, so the delivery's outer pass still consumes it, exactly as the old outer-frame clear
+    // left it in hand.**
     constraintCrossing(refusal);
   }
+  // **⟶ AND THE RESTART'S REFUSAL, WHERE THE RESTARTED CHECK REFUSED — `D-42` (2026-10-27), REACHED THROUGH
+  // THE REPORT SINCE 2026-10-27.** The attempt's own terminal arm returned (its pass, its save and its
+  // delivery all ran, so a listener body's `rollback` and a constraint body's `rollback` have both been
+  // taken), and `runAttempt` — INSIDE ITS OWN COMMIT SCOPE — drained the request and re-ran the check from
+  // its beginning (`drainRestartRequests`). **WHAT THIS FRAME DOES NOW IS REFUSE, AND IT REFUSES WITH THE
+  // VERY VALUE THE RESTARTED CHECK BUILT** — carried on the report under the symbol both sides spell, and
+  // thrown here as itself: the same plain `{status, message, log}`, the same rank-`20` status, one log entry,
+  // and the store already restored by that refusal's own compensating act. **NOTHING IS RE-RENDERED AND NO
+  // SENTENCE IS AUTHORED HERE** (`DD-52`). **A WRITE WHOSE WINDOW HELD ONLY LAWFUL ACTIONS FINDS NO CARRIED
+  // REFUSAL AND RETURNS ITS RECORD UNCHANGED.**
+  const restarted = report !== null && typeof report === 'object' ? report[RESTART_REFUSAL] : undefined;
+  if (restarted !== undefined) {
+    constraintCrossing(restarted);
+  }
   // **⟶ THE PASSING ARM RETURNS THE REPORT THE ATTEMPT ITSELF BUILT — `D-40`'S SECOND HALF (`DEF-M` (2)),
   // 2026-10-26.** **WHAT IT WAS:** `return answer` returned the **STORE LEG'S** record — the one `index.mjs`
   // builds from the store's first reply at this verb — and DISCARDED the report `runAttempt` had just
@@ -946,6 +984,24 @@ const BODY_THREW_STATUS = 'ConstraintBodyThrew';
 /// by save failures only.
 const CONSTRAINT_PASS_REFUSED = 'ConstraintPassRefused';
 
+/// **THE SET'S FIFTEENTH MEMBER, SPELLED ONCE — AND THE ONE THING THE RESTORE'S SAVE CAN ANSWER** (`src/error.rs`'s
+/// `CODES`, `[&str; 20]`, rank `15`; `§8.1` #15 and `§8.2`'s row). **IT IS READ HERE TO CLASSIFY THE STORE'S ANSWER
+/// AND IS NEVER MINTED HERE** (`DD-40`): `restoreMark` answers it when the restore's own save cannot land, and
+/// **that arm is NOT a refused mark** — the store's replay has already run, so the in-memory state IS the restored
+/// state and only the bytes at the path were not updated (`src/store.rs`'s `restoreMark`, 2026-10-27).
+const FILE_COMMIT_FAILED = 'FileCommitFailed';
+
+/// **WHETHER THE STORE'S ANSWER TO THE MARK IS ITS SAVE'S FAILURE RATHER THAN A REFUSED MARK** — the two arms
+/// `restoreMark` can answer with an error, told apart by the status they carry and by nothing else. **A REFUSED
+/// MARK** (`JournalOpUnknown`, `AddressMalformed`) leaves the store at the state it held, so nothing may be
+/// counted as restored; **A FAILED SAVE** (`FileCommitFailed`) leaves the restore's state STANDING in memory and
+/// only the file behind it stale. The answer is the refusal record itself on the save arm and `null` otherwise.
+function saveRefused(refused) {
+  if (refused === null || typeof refused !== 'object') return null;
+  const status = ownDataMember(refused, 'status');
+  return status === FILE_COMMIT_FAILED ? refused : null;
+}
+
 /// **WHETHER THE HANDED VALUE CARRIES THE KERNEL'S BODY-THROW MARK, AND WHAT THE MARK CARRIES** — the mark's
 /// presence is the identity and the record under it is the two slots the generator's sentence needs. **A
 /// NON-OBJECT IS `null`** without a member read, and **a value the kernel never caught from a body is `null`**
@@ -1190,6 +1246,29 @@ function constraintCrossing(refusal) {
 /// measurement of convenience: judging a step *"would invoke bodies mid-attempt and break `D-40`'s 'leaves
 /// the store exactly as it found it'"* (`§2.6` item 1). A verb window is in flight whatever its attempt map
 /// says, and its state is not the state that stands.
+///
+/// **⟶ AND THE SECOND DIRECTION IS CLOSED BY `D-44`, 2026-10-27 — THE PARAGRAPH ABOVE IS READ THROUGH THIS
+/// ONE AND NOTHING BELOW IT MOVES.** *"There should be no state where a constraint is being checked without an
+/// open commit. Any action that would cause a constraint check should open a commit before beginning"*
+/// (`strata/decisions.md` · `D-44`), and the state it names by hand is exactly the one printed above: *"`D-42`'s
+/// window `4` (a pass driven by hand, `open=0`/`live=1`): **that state must not exist**."* **SO A PASS DRIVEN
+/// STRAIGHT THROUGH `K-2`/`K-3` NOW SEES `open` `1`, `live` `1`** — the pass opens its own scope
+/// (`kernel-attempt.mjs`'s `runAttempt`, through the `commit-scope` channel `state.mjs` installs) — **and
+/// `reversalAtRest` IS UNMOVED**: both conjuncts stand, the restart is not a third conjunct, and a reversal
+/// inside a directly driven pass is still a STEP (the `live` conjunct decides it now, where before either
+/// conjunct would have).
+///
+/// **⟶ AND THE PARAGRAPH JUST ABOVE IS SUPERSEDED ON ONE SENTENCE, 2026-10-27 — THIS FILE DOES NOW CONSUME THAT
+/// PASS'S REQUEST, AND IT DOES SO WHERE THE SCOPE IS OWNED.** The bytes that stood here read *"WHAT THIS FILE
+/// STILL DOES NOT DO FOR THAT PASS IS CONSUME ITS REQUEST: the restart's only consumer is `constraintWrite`'s
+/// `restartInvalidatedCheck`, and a directly driven pass has no such frame above it, so a body's request dies
+/// with its window through the epoch rule (`clearStaleRestart`)"*, and **`clearStaleRestart` and the
+/// `CHECK_DEPTH` frame that guarded it are DELETED with that sentence** (`drainRestartRequests` below; the
+/// request now names the window that raised it, `currentWindow` in `state.mjs`). **`D-44`'s declared consequence
+/// is delivered rather than restated** — *"If every check has a commit, every request has a consumer, and the
+/// consumer stops being a property of one call site"* — **and `reversalAtRest` is STILL UNMOVED**: the
+/// conjunction keeps both conjuncts, the restart is not a third conjunct, and the invariant stays the
+/// PRECONDITION of the check (`open` `≥` `1`), enforced at the check.
 /// **SO THE DISCRIMINATOR ANSWERS *AT REST* IFF BOTH ARE ZERO**, which matches the clause's words and its
 /// reason at once, **AND IT STILL CANNOT FAIL**: the open-commit count is taken through `state.mjs`'s
 /// exported `openCommits(store)` — a PLAIN ACCESSOR over the same index the channel reads, NOT the channel
@@ -1208,11 +1287,334 @@ function reversalAtRest(instance) {
   return openCommits(instance) === 0 && kernelFor(instance).live.size === 0;
 }
 
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+// **⟶ ADDED 2026-10-27 — `D-42`: AN ACTION INSIDE AN OPEN COMMIT RESTARTS THE CONSTRAINT CHECK**
+// ═══════════════════════════════════════════════════════════════════════════════════════════════════════
+//
+// **THE RULING IS THE ARCHITECT'S, VERBATIM: *"Actions inside of an open commit start the constraint check
+// over again."*** (`strata/decisions.md` · `D-42`). **THE WINDOW IT CLOSES, AS THE DOWNSTREAM MEASURED IT:** a
+// reversal issued INSIDE an open commit — from a listener body, from a constraint body — was UNJUDGED (the
+// conjunction above), **so its violating effect STOOD** — *"zero judgement invocations inside a body, while
+// the identical call one frame out is refused and restored"* (`D-41` item `3`), **the conservative direction
+// turned out to be the permissive one.**
+//
+// **THE ANSWER IS NEITHER TO JUDGE THE STEP NOR TO LEAVE IT.** **Judging the reversal at its own instant is
+// what the conjunction refuses and `D-38` refuses by name** (a per-step check of an intermediate state,
+// invoking bodies mid-attempt). **So the action is RECORDED and the check it invalidated IS RESTARTED — from
+// its beginning — at the one place the check runs and once the window that held it has finished:**
+//   * **NOT A PER-STEP JUDGEMENT**: the `rollback` call itself still answers its declared record
+//     (`{opId, undoneOps, restoredTo}`, `PAR-JS-9`), no body is invoked at its instant, and the reversal is
+//     never judged *as a step*;
+//   * **NOT A RE-ENTRY INTO THE ATTEMPT**: the attempt's own pass is untouched; what restarts is the check
+//     the action invalidated — the reversal's judgement — and it runs as a FRESH pass over EVERY enabled pair
+//     from the first, against the state the action left (`judgeReversal` over the watch below);
+//   * **NOT MID-UNWIND**: the kernel's own unwinding (`kernel-terminal.mjs`'s `composeRollback`) reaches the
+//     addon's `rollback` entry DIRECTLY and never this member, so it raises no restart and invokes no body
+//     inside the composition. **A RESTART IS ONLY EVER RAISED BY A CONSUMER'S OWN `rollback` MEMBER CALL.**
+//
+// **THE CHECK'S OWN BEGINNING IS THE WATCH'S WALK** (`watchStanding` below): every enabled pair's every
+// address, in `D-39`'s registration order — the same first address and the same first pair the at-rest
+// judgement begins at. **THE RESTART THEREFORE ASKS THE SAME CHECK THE AT-REST CONTROL ASKS, at the state
+// the action left**, which is why its outcome is the declared one member for member: the one plain form
+// (`{status, message, log}`), the set's rank-`20` member `ConstraintPassRefused`, and **the store restored by
+// the refusal's own compensating act** (`restoreReversal` → the store's `restoreMark`, the journal's head —
+// and a reversal appends no journal entry, so that head describes the state that stood BEFORE the action).
+//
+// **TERMINATION, AND WHAT BOUNDS IT.** A restart asks pair bodies, and a pair body MAY ACT (it is the
+// caller's code): an action raised while a restart is running raises a NEW request, which the same loop
+// consumes — so a body that acts on every ask would otherwise restart the check for ever. **THE LOOP IS
+// BOUNDED AT `RESTART_LIMIT` RESTARTS PER PASS SCOPE** (`drainRestartRequests`; the frame moved from the
+// terminal call to the check's own scope on 2026-10-27, and the figure and the never-reset rule did not), and the budget is
+// SPENT, not reset, by a request raised inside a restart. **A CHECK THAT WILL NOT SETTLE IS A CHECK THAT DOES
+// NOT PASS** (`D-41` item `4`'s own direction: *"a reversal nobody could judge is a reversal nobody could
+// approve"*), so the arm past the budget refuses — the same plain form, the same rank-`20` status, the same
+// compensating restore — and its one log entry says the budget was spent. **THE MEASURED COUNT IS THE
+// CELL'S**: `tests/e2e/in-commit-restart.test.mjs` drives a pair that acts on every ask and reads the ask
+// count the bound produces.
+
+/// **THE PER-INSTANCE RESTART RECORD, AND IT IS THE INSTANCE'S OWN** (`D-30`; `D-46`): a `WeakMap` keyed by
+/// the store object, so a second store is a second record, the record dies with its store, and **NO MEMBER IS
+/// ADDED TO THE PRODUCT, TO A RECORD OR TO THE KERNEL** (`A117` (D6)'s four-member guardrail is untouched).
+///
+/// **`pending` IS THE REQUEST** — `{ watched, reversalId, window }`:
+///   * `watched` the check's own beginning captured BEFORE the action ran (`reversalWatch`);
+///   * `reversalId` the store's own echo of the id the reversal named (attached by `judgeReversal` in the same
+///     frame, one line after the action);
+///   * **⟶ `window` the IDENTITY OF THE COMMIT THE ACTION WAS TAKEN IN** (`state.mjs`'s `currentWindow`, minted
+///     with the opening and answered by every joining call), **ADDED 2026-10-27 — AND IT IS WHAT RETIRES THE
+///     COUNTING FRAME.** `D-42`'s own sentence is *"a request belongs to the act that raised it"*; while the
+///     only consumer was `constraintWrite` that fact had to be approximated by a stack depth in that frame
+///     (`CHECK_DEPTH`, whose one read cleared a request at the outermost write). **The store already knows
+///     which commit is open** — it opened it — so the request now NAMES that commit and the consumer compares
+///     the two identities. A request raised in a window whose check never ran (a `delete`'s delivery is the one
+///     the declaration names) therefore dies at the next pass's drain **by identity and not by inference**, and
+///     a request raised earlier in the SAME window (a listener body's, consumed by a nested write's own drain or
+///     by the enclosing pass's) still belongs to that window and is still consumed.
+const RESTARTS = new WeakMap();
+
+/// **HOW MANY RESTARTS ONE PASS'S COMMIT SCOPE MAY TAKE** — the bound `drainRestartRequests` spends. Three is
+/// the declared figure: two fewer than any arm of this package's own batteries drives, and enough that a lawful
+/// in-commit action's single restart never meets it.
+///
+/// **⟶ AND WHAT IT NOW COUNTS IS *RESTARTS PER SCOPE*, NOT PER WRITE, 2026-10-27.** The figure and the
+/// spend-and-never-reset rule are unmoved (`D-42` item `3`); **what moved with the consumer is the frame the
+/// count belongs to**: one drain is one pass's scope — the pass the kernel ran, direct or production — and a
+/// request raised INSIDE a restart is consumed by that same drain and spends that same budget. **A NESTED
+/// pass (a listener body's own write) is a scope of its own and has its own budget**, exactly as the nested
+/// `constraintWrite` frame had its own before the move; the count was never shared across nesting levels and is
+/// not now.
+export const RESTART_LIMIT = 3;
+
+/// **THE RESTART RECORD, CREATED ON THE FIRST ACTION AND NEVER ON A LAWFUL WRITE'S PATH**: the read is a
+/// `WeakMap.get` and the creation happens only in `reversalWatch`'s in-flight arm.
+function restartRecord(instance) {
+  let record = RESTARTS.get(instance);
+  if (record === undefined) {
+    record = { pending: null };
+    RESTARTS.set(instance, record);
+  }
+  return record;
+}
+
+/// **⟶ THE RESTART ITSELF, MOVED 2026-10-27 TO WHERE THE COMMIT SCOPE IS OWNED — `runAttempt`'s drain.**
+///
+/// **WHAT IT WAS, AND THE FINDING THAT MOVED IT.** It was `restartInvalidatedCheck(instance)`, called by
+/// `constraintWrite` after the write's terminal call, and its own header said so: *"it is reached at the ONE
+/// place the check runs after the window that held the action has finished: `constraintWrite`."* **`D-44` then
+/// made every check run inside a commit scope and named the consequence it could not yet deliver** — *"If every
+/// check has a commit, every request has a consumer, and the consumer stops being a property of one call
+/// site"* — **and the window it left is measured at `tests/e2e/direct-pass-commit-invariant.test.mjs`: a pass
+/// driven straight through `K-2`/`K-3` has no `constraintWrite` frame above it**, so a constraint body's
+/// violating `rollback` inside it was neither judged at its instant nor restarted, and the pair was never asked
+/// at the state the action left.
+///
+/// **SO THE CONSUMER IS NOW THE PASS'S OWN SCOPE.** `kernel-attempt.mjs`'s `runAttempt` runs its pass inside
+/// `state.mjs`'s commit scope and then calls the store's `restart-drain` channel **inside that same scope**,
+/// handing the report the pass answered with; this function is the implementation that channel is given
+/// (`installRestartConsumer` below). **ONE MECHANISM, NOT TWO**: there is no second consumer, no counting frame
+/// and no call site to be bypassed — the pass that asks the pairs is the frame that consumes what its own
+/// bodies raised, whichever driver called it.
+///
+/// **EACH ROUND CONSUMES ONE REQUEST OF THIS WINDOW AND ASKS EVERY ENABLED PAIR THE WATCH CARRIED, IN ORDER,
+/// AT THE STATE THE ACTION LEFT** (`judgeReversal`: the `moved` test, the first-violating-pair rule and the
+/// refusal's restoring compensation are that function's own and are not re-implemented here). **THE ROUND IS
+/// THE RE-RUN**: the attempt's own pass is untouched and not re-entered (`D-42`: *"NOT A RE-ENTRY INTO THE
+/// ATTEMPT"*); what restarts is the check the action invalidated, from its first pair, at the state the action
+/// left.
+///
+/// **A VIOLATION IS CARRIED INTO THE REPORT AND NOT THROWN OUT OF THE KERNEL** (`carryRestartRefusal` below):
+/// `runAttempt` answers a report whose `outcome` is `'failed'` and whose log holds the refusal's entry, and
+/// `constraintWrite` — the entry — is the frame that refuses on the write's path. **THAT IS THE ONE FORM BOTH
+/// DRIVERS CAN READ**: a write meets the same plain `{status, message, log}` it met before (the carried refusal,
+/// byte for byte), and a bare `K-3` meets a REPORT that says the restarted pass refused — it never throws,
+/// because the pass it was asked to run passed and the refusal is a later check's.
+///
+/// **A LAWFUL STATE REFUSES NOTHING**: the round asks and passes, the request is consumed, and the report
+/// stands exactly as the pass built it (`outcome` `'passed'`), so a write whose window held only lawful actions
+/// returns its own record unchanged.
+///
+/// **THE BOUND, IN ONE SENTENCE: rounds are counted per pass scope and not reset, so the loop runs at most
+/// `RESTART_LIMIT` restarted rounds however many actions a body raises inside it; the arm past the budget
+/// carries the same form and the same status and restores what the request's own watch recorded as owed.**
+/// A request whose watch is empty is a check with no pair to ask: it consumes its request and returns, so an
+/// empty watch can neither loop nor exhaust the budget.
+export function drainRestartRequests(instance, report) {
+  const record = RESTARTS.get(instance);
+  if (record === undefined) return report;
+  // THE WINDOW THE DRAINING PASS RUNS IN — the pass's own scope is open above this call (`D-44`), so a request
+  // raised by a body of that pass carries this same identity and one raised in an earlier window does not.
+  const window = currentWindow(instance);
+  let rounds = 0;
+  for (;;) {
+    const request = record.pending;
+    if (request === null) return report;
+    // **A REQUEST BELONGS TO THE ACT THAT RAISED IT — MEASURED** (`D-42` item `3`'s closing sentence): a request
+    // standing from a window this pass did not open has no consumer HERE, and it is dropped rather than
+    // attributed to an unrelated check. **IT DIES WITH ITS WINDOW, AND THAT IS THE DECLARED FAIL-STATE**
+    // (`D-43` item `2`: the file reloads or the client regenerates the store). **TWO WINDOWS HOLD A COMMIT AND
+    // RUN NO PASS, AND THEY ARE NAMED RATHER THAN LEFT TO A MEASUREMENT**: a `delete`'s listener delivery (a
+    // delete consults no constraint, `D-1-bis`) and a REGISTRATION's own evaluation (`addConstraint`/
+    // `register`, whose body is asked at an instant no attempt of the pass kind stands at — `context.attempt`
+    // is `null` there). A request raised by a body inside either one has no consumer and dies here.
+    if (request.window !== window) {
+      record.pending = null;
+      return report;
+    }
+    record.pending = null;
+    if (request.watched.length === 0) continue;
+    rounds += 1;
+    if (rounds > RESTART_LIMIT) {
+      // THE CHECK DID NOT SETTLE: THE SAME FORM, THE SAME STATUS, THE SAME COMPENSATION (`D-41` item `4`'s
+      // direction), and the log entry says the budget was spent rather than that a pair refused.
+      const one = request.watched[0];
+      const after = standingAt(instance, one.address);
+      const undo = restoreReversal(instance, request.watched);
+      return carryRestartRefusal(report,
+        reversalRefusal(one, after, null, request.reversalId, undo, null, true));
+    }
+    try {
+      judgeReversal(instance, request.watched, request.reversalId);
+    } catch (refused) {
+      // THE REFUSAL IS THE OUTCOME: the store was restored by its own compensation inside `judgeReversal`, and
+      // a request raised by the refusal's own bodies stands for nobody — the restarted check is over, so the
+      // drain neither asks again nor spends a further round.
+      record.pending = null;
+      return carryRestartRefusal(report, refused);
+    }
+  }
+}
+
+/// **⟶ ADDED 2026-10-28 — `D-49`: THE DISCARD'S WITNESS, AND IT IS READ BY THE ACT WHOSE WINDOW DISCARDED THE
+/// REQUEST.**
+///
+/// **THE RULING, THE ARCHITECT, VERBATIM: *"Make discard observable"*** (`strata/decisions.md` · `D-49`), and
+/// **`DEF-AH` is the defect it answers**: a restart request raised inside one of the two windows that run **no
+/// pass** — a `delete`'s listener delivery, and a registration's own evaluation — **died with its window and the
+/// caller could not learn that it did.** **The fail-state stands** (`D-43` item 2, both exits) — **what was
+/// missing was the WITNESS.**
+///
+/// **WHAT THIS FUNCTION IS, AND WHAT IT IS NOT.**
+///   * **IT RUNS NO PASS, NO BODY AND NO JUDGEMENT.** It reads the instance's own restart record — the record
+///     `reversalWatch` raised the request in — and answers a fresh copy of the two facts a consumer needs: the
+///     id the reversal named (`reversalId`, the store's own echo) and the addresses the discarded check would
+///     have been asked at (`the watch's addresses`, deduplicated by spelling and copied segment for segment).
+///     **THE STORE IS NOT TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS
+///     MOVED** — the `D-49` bar: *"a witness is not a refusal: the act still answers what it answered, the
+///     discard is reported beside it, and nothing new is minted in the closed status set."*
+///   * **IT CONSUMES THE REQUEST IT REPORTS.** A request whose window is the caller's has no consumer that could
+///     ever run it (the window's act ran no pass, and a later pass compares the identity and drops it — the
+///     drain's own arm), so clearing the slot here moves no behaviour: it is the same clearing the drain would
+///     perform on a mismatched window and the at-rest watch performs on a new reversal. **IT ONLY EVER CLEARS A
+///     REQUEST OF THE WINDOW HANDED IN** — a request raised in another window is left exactly where it stands,
+///     so an enclosing act's own consumer is never robbed of it.
+///   * **IT IS NOT THE DRAIN.** `drainRestartRequests` is the consumer of a pass's own window and RUNS the
+///     restarted check; this function is the consumer of a window that has none and only REPORTS it. **Two
+///     consumers, two windows, and neither takes the other's request** (`D-44`: *"every request has a
+///     consumer"* — for the two passless windows the consumer is the caller's own record).
+///
+/// **THE BOUND, STATED SO THE WITNESS IS NOT READ AS MORE THAN IT IS.** The restart record holds **ONE** pending
+/// request (a second in-flight action overwrites the first — the record's own declared shape, UNMOVED by this
+/// pass), so the witness reports the LAST request the window raised and no list of earlier ones exists to report.
+/// **The registration window is the other named window and it has no such reader**: its answer is an identity, and
+/// the identity is opaque by declaration, so nothing this function could answer would reach it without a new
+/// surface — `D-49`'s own instruction is to say so rather than to invent one.
+export function witnessDiscardedReversal(instance, window) {
+  const record = RESTARTS.get(instance);
+  // NO ACTION WAS EVER TAKEN ON THIS INSTANCE, OR THE LAST ONE WAS ALREADY CONSUMED: nothing stands to report.
+  if (record === undefined || record.pending === null) return null;
+  const request = record.pending;
+  // **A REQUEST BELONGS TO THE ACT THAT RAISED IT** (`D-42` item 3, measured by the `window` stamp of
+  // 2026-10-27): a request standing from another window is that window's and is left where it stands.
+  if (request.window !== window) return null;
+  record.pending = null;
+  const addresses = [];
+  const spellings = [];
+  for (let index = 0; index < request.watched.length; index += 1) {
+    const address = request.watched[index].address;
+    const spelling = homeAddressKey(address);
+    let seen = false;
+    for (let known = 0; known < spellings.length; known += 1) {
+      if (spellings[known] === spelling) {
+        seen = true;
+        break;
+      }
+    }
+    // ONE ADDRESS ONCE: two pairs over one address (or one pair naming it twice) are one address the check owed,
+    // and the witness reports the subject and not the walk.
+    if (seen) continue;
+    appendOwn(spellings, spelling);
+    // **A FRESH SEGMENT LIST PER ADDRESS** (`crossing.md §1.1`'s copy-out discipline): the pair's own array is
+    // the registry's and is never handed to a caller.
+    const copy = [];
+    for (let segment = 0; segment < address.length; segment += 1) appendOwn(copy, address[segment]);
+    appendOwn(addresses, copy);
+  }
+  // THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED — `null` where the reversal's call answered no id (the
+  // request stands and the act's answer did not reach the echo, which is a real arm a caller can see).
+  return {
+    opId: typeof request.reversalId === 'string' ? request.reversalId : null,
+    addresses,
+  };
+}
+
+/// **⟶ THE REFUSAL'S ONE CARRIER TO WHICHEVER DRIVER ASKED — ADDED 2026-10-27.**
+///
+/// **THE REPORT IS AMENDED IN TWO PLAIN MEMBERS AND CARRIES THE REFUSAL WHOLE UNDER A THIRD, SYMBOL-KEYED
+/// ONE:**
+///   * **`report.outcome` BECOMES `'failed'`** — the attempt's answer is the restarted check's. The pass it
+///     ran DID pass, and the state that pass approved does not stand: the action taken inside its window was
+///     reversed and the check that state was re-judged by refused it, so the store is back at the journal's
+///     head and not at the pass's own op. **THE TWO-ARM MEMBER KEEPS ITS TWO ARMS** (`'passed'`/`'failed'`,
+///     `attempt-lifecycle.md §2.4` item 3's terminal-arm clause): no third value is minted;
+///   * **THE REFUSAL'S OWN LOG ENTRY IS APPENDED TO THE ATTEMPT'S LOG** — one `constraint-check` entry naming
+///     the pair that refused the state the action left and saying what the refusal's compensating act did
+///     (`undoSpelling`). **IT ENTERS THROUGH THE KERNEL'S OWN `append`**, so it carries the log's six declared
+///     members and the log's own ordinal: the entry the driver reads in `report.log` is a log entry of the
+///     attempt's log and not a record of another kind. **THE REFUSAL'S OWN LIST KEEPS ITS FIVE MEMBERS AND NO
+///     `seq`** — that list is the judgement's and no attempt log stands at its own instant (`D-41` item `4`) —
+///     so the copy is the report's and the original is the refusal's, each honest in its own record;
+///   * **AND THE REFUSAL ITSELF TRAVELS UNDER `RESTART_REFUSAL`** so that `constraintWrite` re-throws THE VERY
+///     VALUE the restarted check built — same `status`, same `message`, same `log` — with nothing re-rendered
+///     and no second spelling of the store's sentence (`DD-52`).
+///
+/// **NO MEMBER IS ADDED TO THE REPORT'S READABLE SHAPE**: it keeps its five (`attempt`, `outcome`, `ops`,
+/// `log`, `rollback`), the symbol key is invisible to `Object.keys` and to `Object.getOwnPropertyNames`
+/// (`A117` (D6)), and `K-5` answers the same list a `K-3` answered because it is the same object.
+const RESTART_REFUSAL = Symbol.for('provident-storeroom.restart-refusal');
+
+/// **THE AMENDMENT ITSELF — the one site that writes the report a restarted check refused.**
+function carryRestartRefusal(report, refusal) {
+  report.outcome = 'failed';
+  const carried = refusal !== null && typeof refusal === 'object' && Array.isArray(refusal.log)
+    ? refusal.log
+    : [];
+  // THE APPEND IS THE KERNEL'S OWN (`append`): a local holder carrying the report's own list, so the ordinal
+  // is `log.length + 1` exactly as every other entry of this log was minted, and no `Array.prototype.push` is
+  // read on this path (`contract.md §2.1`'s clause of 2026-10-24 on `F8-2`).
+  const log = { log: report.log };
+  for (let index = 0; index < carried.length; index += 1) {
+    const entry = carried[index];
+    append(log, entry.kind, entry.id, entry.opId, entry.message, entry.state);
+  }
+  Object.defineProperty(report, RESTART_REFUSAL, {
+    value: refusal,
+    writable: false,
+    enumerable: false,
+    configurable: true,
+  });
+  return report;
+}
+
+// **⟶ AND THE CHANNEL IS GIVEN ITS IMPLEMENTATION HERE, AT THIS FILE'S OWN MODULE SCOPE.** `state.mjs` owns
+// the seam and may not import this file (`constraints.mjs` imports IT, and the kernel imports neither), so the
+// consumer is injected rather than imported: one registration, one consumer, and the kernel reaches it by the
+// `Symbol.for('provident-storeroom.restart-drain')` channel `installAttemptSeam` installs on every store.
+installRestartConsumer(drainRestartRequests);
+
 /// **THE WATCH — THE PRE-REVERSAL STANDING OF EVERY ENABLED PAIR'S EVERY ADDRESS**, taken before the addon's
-/// `rollback` entry is called. **IT IS A LIST OF `{entry, address, before}` AND NOTHING ELSE**: the entry is
-/// the pair's own record (so the judgement needs no second lookup and no registry read after the reversal),
-/// the address is the pair's own segment array (never a copy, never mutated here) and `before` is what the
-/// store stood at when the reversal was asked for.
+/// `rollback` entry is called. **IT IS A LIST OF `{entry, address, before, beforeTier, beforeTiers}` AND
+/// NOTHING ELSE**: the entry is the pair's own record (so the judgement needs no second lookup and no registry
+/// read after the reversal), the address is the pair's own segment array (never a copy, never mutated here)
+/// and the standing is what the store held when the reversal was asked for.
+///
+/// **⟶ AND THE WATCH CAPTURES THE TIER AND NOT ONLY THE VALUE, 2026-10-27 — `D-41` ITEM `2`, MEASURED.** The
+/// list this clause declares was `{entry, address, before}` and `before` was the CROSS-TIER read alone, so the
+/// restore could not know **where** the value stood and put everything back at `mem` (`restoreReversal` below
+/// states what that cost). **THE TIERS ARE THREE AND RANKED `file` > `mem` > `temp`** (`src/records.rs`'s
+/// `Tier`), **the zero-tier `read` answers the LOWEST-tier version present at each key** (`src/store.rs`'s
+/// `select_member`), **and the tier argument narrows that same read to one tier** (`src/args.rs`'s
+/// `read_tier_sel`) — so the watch takes the standing the judgement reads
+/// AND one narrowed read per tier:
+///   * **`before`** is the same cross-tier standing it always was (the judgement's subject and the "touched"
+///     test are unchanged, `sameStanding`);
+///   * **`beforeTiers`** is every tier at which the address STOOD, captured in the store's canonical
+///     `file` · `mem` · `temp` order, each with the value that tier answers — **the exact state a restore has
+///     to put back**, one write per tier, and the only way a value at `file` survives;
+///   * **`beforeTier`** is the tier the cross-tier read drew from (the lowest-rank standing tier), or `null`
+///     where the address stood at no tier at all — *"where the value stood"*, spelled once for the message.
+/// **THE ABSENT ARM IS THE ZERO-READ'S OWN**: where the cross-tier read refuses, the address stands at no
+/// tier, so `before` is `undefined`, `beforeTiers` is `[]` and `beforeTier` is `null` — the state the restore
+/// must return the address to by REMOVING what the reversal left there.
 ///
 /// **IT IS EMPTY WHERE THE ENTRY CARRIES NO PAIR**, so the whole judgement — and every read it would take —
 /// is skipped for the overwhelming majority of `rollback` calls, and a store that never registered a
@@ -1220,13 +1622,49 @@ function reversalAtRest(instance) {
 export function reversalWatch(state, instance) {
   const watched = [];
   if (state.constraints.size === 0) return watched;
-  // A REVERSAL INSIDE AN OPEN COMMIT **OR** AN OPEN ATTEMPT IS A STEP AND NOT A TERMINAL STATE — see
-  // `reversalAtRest` above (the conjunction of 2026-10-26), which states the ground. The watch answers `[]`
-  // there, so no read is taken and no body is invoked.
-  if (reversalAtRest(instance) === false) return watched;
-  // **THE WALK IS `D-39`'S DECLARED ORDER** — the record's own `registrationSeq`, collected and ordered
-  // exactly as `enumerateConstraints` collects and orders its answer — so the pair the judgement reaches
-  // FIRST is the pair `constraints()` names first, and not whichever pair a toggle happened to move.
+  // **⟶ AND A REVERSAL INSIDE AN OPEN COMMIT IS NO LONGER LEFT UNJUDGED — `D-42`, 2026-10-27.** The bytes
+  // below stood as *"the watch answers `[]` there, so no read is taken and no body is invoked"*, and the
+  // SECOND HALF of that sentence is now WITHDRAWN BY NAME: **no body is invoked here (the action is not judged
+  // at its instant — the step is still not judged as a step), while the WATCH IS TAKEN and the check is
+  // RESTARTED where the check runs** (`drainRestartRequests`). **THE READS ARE THE SAME READS THE AT-REST
+  // JUDGEMENT TAKES AND THEY ARE THE RESTART'S DEBT RECORD**: what stood at each enabled pair's address before
+  // the action ran — the state the refusal's compensating act owes back, and the baseline its verification
+  // reads. **A REVERSAL INSIDE AN OPEN COMMIT OR AN OPEN ATTEMPT IS STILL NOT A TERMINAL STATE** and
+  // `reversalAtRest` is UNCHANGED (the conjunction keeps both conjuncts; the restart is not a third conjunct):
+  // what moves is only what happens to the request after the window closes.
+  //
+  // **⟶ AND FROM 2026-10-27 THE REQUEST NAMES THE WINDOW IT WAS RAISED IN** (`currentWindow`, `state.mjs`): the
+  // identity of the commit open at this instant, minted with the opening. **THAT STAMP IS THE WHOLE OF THE
+  // EPOCH RULE NOW** — the consumer (`drainRestartRequests`) compares it against the window the draining pass
+  // runs in, so *"a request belongs to the act that raised it"* (`D-42` item `3`) is MEASURED at this line and
+  // checked at that one, and the `CHECK_DEPTH` frame that once approximated it is deleted with its clears.
+  if (reversalAtRest(instance) === false) {
+    restartRecord(instance).pending = {
+      watched: watchStanding(state, instance),
+      reversalId: null,
+      window: currentWindow(instance),
+    };
+    return watched;
+  }
+  // **AND AN AT-REST CALL PROVES THE PREVIOUS WINDOW HAS ENDED**: a request still standing there belongs to a
+  // window whose check never ran (a `delete`'s delivery is the one the declaration names), and the act that
+  // raised it is over — so it dies here rather than being attributed to this reversal.
+  const record = RESTARTS.get(instance);
+  if (record !== undefined) record.pending = null;
+  return watchStanding(state, instance);
+}
+
+/// **THE CHECK'S OWN BEGINNING — THE WATCH'S WALK, TAKEN AS ONE FUNCTION SO THE AT-REST JUDGEMENT AND THE
+/// RESTART BEGIN AT THE SAME FIRST PAIR.**
+///
+/// **THE WALK IS `D-39`'S DECLARED ORDER** — the record's own `registrationSeq`, collected and ordered exactly
+/// as `enumerateConstraints` collects and orders its answer — so the pair the judgement reaches FIRST is the
+/// pair `constraints()` names first, and not whichever pair a toggle happened to move. **A PAIR WHOSE ELEMENT
+/// DOES NOT STAND A REGISTRATION IS NOT EVEN CAPTURED** (`withdrawStanding`'s own predicate, and its own
+/// ground: a disabled pair's registry standing is a CARRIAGE fact, not a listener) — so the restart asks
+/// nothing on a disabled pair's address and the budget cannot be spent on one.
+function watchStanding(state, instance) {
+  const watched = [];
   const carried = [];
   for (const entry of state.constraints.values()) {
     appendOwn(carried, entry);
@@ -1234,17 +1672,56 @@ export function reversalWatch(state, instance) {
   carried.sort((left, right) => left.registrationSeq - right.registrationSeq);
   for (let index = 0; index < carried.length; index += 1) {
     const entry = carried[index];
-    // THE PAIR'S ELEMENT MUST STAND A REGISTRATION FOR IT TO BE ASKED ANYTHING (`withdrawStanding`'s own
-    // predicate, and its own ground: a disabled pair's registry standing is a CARRIAGE fact, not a listener).
     if (entry.enabled !== true) continue;
     for (let position = 0; position < entry.addresses.length; position += 1) {
       const address = entry.addresses[position];
-      appendOwn(watched, { entry, address, before: standingAt(instance, address) });
+      const captured = captureStanding(instance, address);
+      appendOwn(watched, {
+        entry,
+        address,
+        before: captured.before,
+        beforeTier: captured.beforeTier,
+        beforeTiers: captured.tiers,
+      });
     }
   }
   return watched;
 }
 
+/// **THE THREE TIER TOKENS, IN THE CANONICAL ORDER A RESTORE MUST WRITE THEM** — `file` · `mem` · `temp`
+/// (`src/records.rs`'s `canonical_tiers`, rank DESCENDING). **THE ORDER IS NOT COSMETIC: a write purges every
+/// version at `rank ≤ rank(write tier)` at the addressed key** (`src/store.rs`'s `W-6`, the `doomed` filter),
+/// **so writing the captured tiers from the most persistent to the least reconstructs a shadow exactly** —
+/// `file`, then `mem`, then `temp`: each write purges only what it outranks and therefore cannot destroy a tier
+/// already put back.
+const STANDING_TIERS = ['file', 'mem', 'temp'];
+
+/// **WHAT STOOD AT ONE ADDRESS, CAPTURED BEFORE THE REVERSAL** — the cross-tier standing the judgement reads
+/// (and the "touched" test compares), the tier that standing was drawn from, and every tier at which the
+/// address stood with the value that tier answers. **AN ADDRESS THAT STANDS AT NO TIER IS THE ZERO-READ'S OWN
+/// ABSENCE**: the cross-tier `read` refuses, no narrowed read is taken, and `tiers` is `[]` — the ONE state the
+/// restore returns the address to by removal rather than by a write.
+function captureStanding(instance, address) {
+  const before = standingAt(instance, address);
+  const tiers = [];
+  // THE NARROWED READS ARE TAKEN ONLY WHERE SOMETHING STANDS: the zero-tier read cannot succeed at an address
+  // that holds an anchor at no tier, so absence is decided once and costs no further read.
+  if (before !== undefined) {
+    for (let index = 0; index < STANDING_TIERS.length; index += 1) {
+      const tier = STANDING_TIERS[index];
+      const stood = standingAtTier(instance, address, tier);
+      if (stood.stood === true) appendOwn(tiers, { tier, value: stood.value });
+    }
+  }
+  return {
+    before,
+    // THE TIER THE CROSS-TIER READ DREW FROM — the lowest-rank standing tier, which is the LAST entry of
+    // `tiers` because `STANDING_TIERS` is rank-descending — and `null` where the address stood at no tier.
+    beforeTier: tiers.length === 0 ? null : tiers[tiers.length - 1].tier,
+    tiers,
+  };
+}
+
 /// **THE JUDGEMENT — THE TERMINAL STATE, ASKED OF EVERY PAIR THE REVERSAL TOUCHED, ONCE.** It answers
 /// `undefined` on the lawful arm (**and the caller's record then crosses unchanged**) and THROWS the surface's
 /// one plain form on the refusing arm. `reversalId` is the store's own echo of the id the reversal named
@@ -1262,97 +1739,362 @@ export function reversalWatch(state, instance) {
 /// **AND THE RESTORE IS NOT JUDGED AND RECURSES INTO NOTHING** (`restoreReversal` below states both): it is a
 /// COMPENSATING ACT and not a consumer write, it reaches the store verb at its entry — no `K-2`, no pass, no
 /// listener delivery and no second `rollback` — and every address it touches is one the watch already read.
+///
+/// **⟶ AND A JUDGEMENT THAT CANNOT COMPLETE FAILS CLOSED, 2026-10-27 — `D-41` ITEM `4`, MEASURED.** A pair body
+/// that THREW at this judgement used to propagate out of this function **with the reversal's effect STANDING and
+/// the refusal's `log` `[]`**: the reversal had already happened, so the store was left at the very state nobody
+/// could judge and the consumer was told nothing about it. **A reversal nobody could judge is a reversal nobody
+/// could approve**, so the throwing arm is treated as the violating arm: **every address the reversal moved is
+/// restored, and the call refuses with a log that NAMES THE THROWING PAIR** — the same treatment a violation
+/// gets. The crossed code stays the body's own rank-`18` member (`ConstraintBodyThrew`, the code that says what
+/// actually happened: a body threw), while the treatment — restore, one log entry naming the pair, one plain
+/// form — is the violation's.
 export function judgeReversal(instance, watched, reversalId) {
-  // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
-  // wider, and the same list is what a refusal has to put back.
-  const moved = [];
-  for (let index = 0; index < watched.length; index += 1) {
-    const one = watched[index];
-    // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
-    // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
-    // reversal found.
-    const after = standingAt(instance, one.address);
-    if (sameStanding(one.before, after) === true) continue;
-    appendOwn(moved, { entry: one.entry, address: one.address, before: one.before, after });
+  // **⟶ AND THE IN-FLIGHT ARM IS THE REQUEST'S OTHER HALF, `D-42` (2026-10-27).** `reversalWatch` answers
+  // `[]` for an action taken inside an open window — no body is invoked at the reversal's instant and the step
+  // is still not judged as a step — **and this frame is where the store's own echo of the id the reversal
+  // named reaches the request the watch raised**: the id is the refusal's `opId` when the restart refuses, so
+  // the declared log entry names the act, exactly as the at-rest control's does. **NO ASK AND NO READ IS TAKEN
+  // HERE** — the restart is not this frame's, and an empty watch with no request standing (the at-rest arm of a
+  // store whose every pair is disabled) is a judgement over nothing and answers `undefined` as it always did.
+  if (watched.length === 0) {
+    const record = RESTARTS.get(instance);
+    if (record !== undefined && record.pending !== null && record.pending.reversalId === null) {
+      record.pending.reversalId = typeof reversalId === 'string' ? reversalId : null;
+    }
+    return undefined;
   }
-  for (let index = 0; index < moved.length; index += 1) {
-    const one = moved[index];
-    const outcome = reversalOutcome(one.entry, one.address, one.after);
-    if (outcome === true) continue;
-    // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
-    // (ii)–(iii), at the reversal's own instant) — and BEFORE the refusal is built, EVERY address the reversal
-    // moved is put back, so the store the consumer meets holds no state this refusal refused.
-    const undo = restoreReversal(instance, moved);
-    throw reversalRefusal(one, one.after, reversalSaid(outcome), reversalId, undo);
+  // **⟶ AND THE AT-REST JUDGEMENT RUNS INSIDE A COMMIT, 2026-10-27 — `D-44`'s INVARIANT AND `DEF-AE`'S CACHE.**
+  // `D-44`: *"There should be no state where a constraint is being checked without an open commit. Any action that
+  // would cause a constraint check should open a commit before beginning."* **THE AT-REST JUDGEMENT WAS THE ONE
+  // CHECK THAT RAN OUTSIDE ONE** — `reversalWatch` had already decided `reversalAtRest` on the count this call
+  // found (`open` `0`, `live` `0`), so the discriminator's reading is unmoved by the opening that follows it —
+  // **and the window it opens is what carries the mark the restore owes back** (`state.mjs`'s `openCommit` caches
+  // the journal's last valid position at the opening; `windowMark` answers it). **A REVERSAL APPENDS NO ENTRY**, so
+  // the mark taken here is still the PRE-REVERSAL state — which is why the at-rest control restores exactly what
+  // it restored before. **ON THE RESTART ARM THIS CALL JOINS** the pass's window (the drain runs inside the pass's
+  // own scope, `kernel-attempt.mjs`) and re-caches nothing, so the mark in flight stays the OUTERMOST opening's:
+  // the position the attempt found. **THE `finally` RELEASES THE WINDOW ON EVERY ARM, INCLUDING THE THROWING ONE**,
+  // because a refusal that leaves a commit standing is the count this package's own cells measure.
+  const opened = openCommit(instance);
+  try {
+    // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
+    // wider, and the same list is what a refusal has to put back — with the tier capture the watch took, so a
+    // restore knows WHERE each value stood and not merely what it was.
+    const moved = [];
+    for (let index = 0; index < watched.length; index += 1) {
+      const one = watched[index];
+      // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
+      // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
+      // reversal found.
+      const after = standingAt(instance, one.address);
+      if (sameStanding(one.before, after) === true) continue;
+      appendOwn(moved, {
+        entry: one.entry,
+        address: one.address,
+        before: one.before,
+        beforeTier: one.beforeTier,
+        beforeTiers: one.beforeTiers,
+        after,
+      });
+    }
+    for (let index = 0; index < moved.length; index += 1) {
+      const one = moved[index];
+      // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
+      // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
+      // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).
+      let outcome;
+      try {
+        outcome = reversalOutcome(instance, one.entry, one.address, one.after);
+      } catch (thrown) {
+        const undo = restoreReversal(instance, moved);
+        throw reversalRefusal(one, one.after, null, reversalId, undo, thrown);
+      }
+      if (outcome === true) continue;
+      // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
+      // (ii)–(iii), at the reversal's own instant) — and BEFORE the refusal is built, EVERY address the reversal
+      // moved is put back, so the store the consumer meets holds no state this refusal refused.
+      const undo = restoreReversal(instance, moved);
+      throw reversalRefusal(one, one.after, reversalSaid(outcome), reversalId, undo, null);
+    }
+    return undefined;
+  } finally {
+    closeCommit(instance, opened);
   }
-  return undefined;
 }
 
-/// **THE REFUSAL'S OWN UNDOING — EVERY ADDRESS THE REVERSAL MOVED IS RESTORED TO ITS PRE-REVERSAL STANDING.**
+/// **THE REFUSAL'S OWN UNDOING — THE STORE RETURNS ITS OWN STATE TO ITS JOURNAL MARK, AND THE WATCH SAYS WHAT
+/// STOOD AGAIN.** **⟶ REWRITTEN 2026-10-27 (THE ARCHITECT'S RULING): `restoreReversal` NO LONGER WRITES
+/// ANYTHING.** It calls ONE store verb — `restoreMark`, the journal's second consumer beside `rollback`, reached
+/// at the boundary's own entry exactly as `rollback` is — and the STORE decides what the pre-reversal state was,
+/// from ITS OWN RECORD.
 ///
-/// **WHY IT IS NOT A JUDGED WRITE.** The restore is the refusal's own compensating act: it runs INSIDE the
-/// refusal's production, after the judgement has already decided, and it reaches the store's verb AT ITS ENTRY
-/// (`withAddon().delete` / `.write`, bound to the instance, carrying the boundary's own encoders) — **so no
-/// `K-2` opens, no pass runs, no `reversalWatch`/`judgeReversal` is re-entered, no listener is delivered and no
-/// pair body is asked a second time.** A consumer call would be judged because it is the state the caller then
-/// reads; **this act is not a state anyone chose, it is the state that stood before the refusal's subject.**
+/// **WHY THE CAPTURE-AND-WRITE IS GONE, STATED AS THE MEASUREMENT THAT RETIRED IT.** The restore used to
+/// reconstruct the state ADDRESS BY ADDRESS and TIER BY TIER from what a READ draws: the watch's per-tier
+/// readings of each enabled pair's address. That cannot rebuild a shadow INSIDE a subtree (a version standing
+/// one level BELOW the pair is captured only inside its parent's assembled value, so writing that value back at
+/// the parent's tier moves the descendant's tier with it), and it cannot cross the store's monotonicity clause
+/// (a `file` version cannot be written back under a parent the reversal left at `mem`). **And it rewrote BY HAND
+/// what the store can REPLAY EXACTLY**: the journal records every operation's address, its before AND its after,
+/// per version and per tier, and `restoreMark` re-states that record (`src/store.rs`'s `§6.6` is the primitive's
+/// declaration). The two shapes the capture could not reach are the two cells added to
+/// `tests/e2e/refused-reversal-restore.test.mjs` — the MIXED-DEPTH SHADOW and the HIGHER-TIER/PARENT case —
+/// and both were RED under the capture-and-write.
+///
+/// **THE MARK IS THE JOURNAL'S HEAD, AND IT IS NAMED BY SUPPLYING NO POSITION.** A reversal appends no entry
+/// (`src/store.rs`'s `rollback`), so after the reversal ran the journal's head still describes the state that
+/// stood BEFORE it — the state this act owes back. The call therefore passes NO position at all, which the
+/// boundary's own codec folds to the carrier's ABSENT arm (`crossing.md §1.3`): the store's own spelling for
+/// *"the head"*.
+///
+/// **⟶ AND THE TWO PARAGRAPHS ABOVE ARE READ THROUGH THEIR MARK, 2026-10-27 — THE ARCHITECT'S RULING, VERBATIM:
+/// *"Cache the restoreMark when opening a commit, based on the last valid state/op of the journal."*** `RCA-8(g)`
+/// ANNOTATE-BESIDE: **every byte above stands and this clause is the operative statement of WHICH mark the act
+/// names.** **THE HEAD IS NO LONGER TRUSTED, AND THE REASON IS THE MEASUREMENT `DEF-AE` FILED:** *"a reversal
+/// appends no journal entry, so the head describes the state that stood before the action"* is TRUE OF A REVERSAL
+/// TAKEN AT REST and FALSE OF ONE TAKEN INSIDE A WRITE'S COMMIT — **in the restart arm the enclosing write's own op
+/// stands at the head when the listener's reversal runs**, so the head described the WRITE'S LANDING and the
+/// compensation restored the refusal's own value: **the store stood at `7` where the attempt found `9`, and the
+/// write that reported the refusal had landed its value.** **SO THE ACT NAMES THE MARK ITS COMMIT CACHED AT ITS
+/// OPENING** — `state.mjs`'s `openCommit` reads the store's own `journalMark` (`src/store.rs`: the last VALID
+/// mark, which is the head at that instant and is named as a VALUE) and stands it on the window; `windowMark`
+/// answers it here, and the store's `restoreMark` replays to it. **THE INSTANT IS THE WHOLE FIX**: the opening
+/// precedes anything the commit lands, so the cached position is the state the attempt FOUND — the pre-attempt
+/// state, which is what a failed attempt owes back. **A JOIN RE-CACHES NOTHING** (`D-45`/`D-46` decide which
+/// openings are outermost: a repair's write and a pass's scope join, so they take the outermost mark and not a
+/// later one), and **a callback's own commit is its own opening with its own cache** (a listener body's call names
+/// nothing and opens, so the mark it restores to is where ITS window opened). **THE MARK IS OPAQUE HERE**: the
+/// store answered a carrier — `{k:'s', v:<op id>}`, or `{k:'F'}` for the FLOOR, the state the store was born with
+/// when the journal held no entry at the opening — and this act hands the very same carrier back. **NEITHER THE
+/// PACKAGE NOR THIS FUNCTION COMPOSES A POSITION.**
+///
+/// **AND A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED: THIS ACT REFUSES RATHER THAN FALLING BACK TO THE
+/// HEAD** — the head is the value this ruling exists to stop trusting, and a silent fall-back would restore it
+/// while a consumer was told the reversal was undone. **THE REFUSAL IS THE ACT'S, NOT THE CALL'S**: no store verb
+/// is invoked, no status is minted (`DD-40`), every address the reversal moved is reported as NOT restored with
+/// what stands there instead, and the log entry says the window carried no cached mark — so the crossed form, its
+/// `status` and its member set are unmoved and the consumer is never told a restoration happened that did not.
+///
+/// **WHAT THE CAPTURE SURVIVES AS, AND WHY IT IS NOT A FALLBACK.** `reversalWatch`'s per-tier capture is still
+/// taken, and it is the ONLY record of **what was owed** — it is the DEBT'S RECORD and the VERIFICATION
+/// BASELINE, not a write plan. Every address the reversal moved is read again after the store's act
+/// (`standingVerdict`), and the count and the failures below are read from THAT — so `UNDONE` is claimed only
+/// where each moved address demonstrably stands again with the values and the tiers it held, which is the
+/// honesty `D-41` item `2` measured at `200` of `200`. **NO WRITE AND NO DELETE IS ISSUED BY THIS FUNCTION ON
+/// ANY ARM**; the store's own verb is the whole act.
 ///
 /// **AND WHY IT CANNOT RECURSE INTO THE MEMBER.** `judgeReversal` is reached from `index.mjs`'s `rollback`
-/// member; the restore never calls that member, the addon's `rollback`, or any package member — only the two
-/// store verbs at the entry — so the judgement's ONE pass over the pairs stays one pass and `D-40`'s floor law
-/// is not re-walked.
-///
-/// **THE ADDRESS IS CLEARED ON EVERY TIER FIRST, THEN SET AT `mem` WHEN A VALUE STOOD THERE.** The watch's
-/// `before` is the CROSS-TIER standing (the same `read` the judgement read), so the address must stand exactly
-/// there and at no tier the reversal left something at; the value is then written at the canonical middle tier.
-/// **THE RECORD OF WHAT IT DID IS RETURNED AND CARRIED INTO THE REFUSAL'S LOG** — a consumer is told the
-/// reversal was undone, and told so plainly where a restore could not be taken.
+/// member; the restore never calls that member, the addon's `rollback`, or any package member — only the store's
+/// `restoreMark` at its entry — so the judgement's ONE pass over the pairs stays one pass and `D-40`'s floor law
+/// is not re-walked. **NO `K-2` OPENS, NO PASS RUNS, NO LISTENER IS DELIVERED AND NO PAIR BODY IS ASKED A SECOND
+/// TIME**: the store's primitive appends no entry, fires no trigger and reads no constraint.
+///
+/// **WHERE THE STORE ITSELF REFUSES, THIS SAYS SO AND WRITES NOTHING.** `restoreMark` refuses in the store's own
+/// declared form (`JournalOpUnknown`) for a mark its journal no longer holds, and the state it holds at that
+/// instant is the state it keeps. The refusal is carried into the message `undoSpelling` builds, so a consumer
+/// is told the store refused and is never told a restoration happened that did not.
+///
+/// **⟶ AND A FAILED SAVE IS A SECOND, DIFFERENT ANSWER — 2026-10-27, THE FILE-SAVE RULING.** `restoreMark` now
+/// answers `FileCommitFailed` when the restore's own save cannot land, **and that answer does not mean the mark
+/// was refused**: the store's replay already ran, so the in-memory state IS the restored state and only the
+/// bytes at the store's file path were not updated. **So the two are classified apart (`saveRefused`) and the
+/// save's arm does NOT narrow the address verification**: every address the restore moved is counted exactly as
+/// on the passing arm, **and the file's own half is counted beside them** (`unsaved`), which is the one datum
+/// `undoSpelling` needs to say *"the memory was restored and the bytes were not"*. **NO BYTE IS WRITTEN HERE AND
+/// NO SECOND SAVE IS ATTEMPTED** — the store's answer is the whole report.
 function restoreReversal(instance, moved) {
   const addon_ = withAddon();
+  // **THE ONE ACT: THE STORE RETURNS ITS OWN STATE TO THE MARK ITS COMMIT CACHED AT ITS OPENING** (`windowMark`,
+  // `state.mjs`) — NOT to the journal's head, which is the write's own landing on the restart arm. **THE CARRIER
+  // IS THE STORE'S OWN ANSWER, HANDED BACK VERBATIM**: `{k:'s', v:<op id>}` names an entry and `{k:'F'}` names the
+  // FLOOR (the state the store was born with, where the journal held no entry when the commit opened). **NOTHING
+  // IS COMPOSED HERE**, so the mark has one spelling and it lives at the store's edge.
+  let refused = null;
+  let cacheless = false;
+  const mark = windowMark(instance);
+  if (mark === undefined) {
+    // **A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED, AND THIS REFUSES RATHER THAN FALLING BACK TO THE
+    // HEAD.** No store verb is invoked, so the store holds the state it held — and the count below claims NO
+    // address restored, so the sentence that reaches the consumer says the reversal was not undone.
+    cacheless = true;
+  } else {
+    try {
+      Reflect.apply(addon_.restoreMark, instance, [mark]);
+    } catch (why) {
+      refused = why;
+    }
+  }
+  // **THE STORE'S ANSWER IS CLASSIFIED BEFORE ANY ADDRESS IS COUNTED — 2026-10-27, THE FILE-SAVE RULING.** A
+  // REFUSED MARK leaves the store as it was, so no address may be claimed restored. **A FAILED SAVE does not**:
+  // the store's replay already ran and the restored state STANDS, so every address is verified and counted
+  // exactly as it is on the passing arm, and the file's own half is recorded beside the count (`unsaved`) for
+  // the ONE sentence that names it. **THIS IS THE VERIFICATION EXTENDED TO THE FILE**: the restore already
+  // counts the addresses it put back; the count is not narrowed by a failure that did not affect them, and the
+  // bytes are reported as the thing that did fail. **AND THE CACHELESS ARM IS A THIRD, WHICH NEVER RESTORES**:
+  // no mark was supplied, so no address may be counted.
+  const unsaved = saveRefused(refused);
+  const stateRestored = cacheless === false && (refused === null || unsaved !== null);
   let restored = 0;
   const failed = [];
+  // ONE VERIFICATION PER ADDRESS: two pairs over one address (or one pair naming it twice) must not be counted
+  // twice, so the addresses already measured are remembered — by a local loop, never by `Array.prototype.includes`
+  // on a refusal path (`contract.md §2.1`'s clause on `F8-2` and item `(2b)`'s row `54`).
+  const measured = [];
   for (let index = 0; index < moved.length; index += 1) {
     const one = moved[index];
-    try {
-      // EVERY TIER AT THE ADDRESS, REMOVED — the receipt is not read and nothing is delivered (`triggered` is
-      // the store's own answer and this act performs no invocation; `surface.md §2.7`).
-      Reflect.apply(addon_.delete, instance, [
-        encodeAddress(one.address, undefined, 'first argument'),
-        encodeTier(undefined, false, false, 'first argument'),
-      ]);
-      if (one.before !== undefined) {
-        const fault = { found: null, value: undefined, path: [], subject: null, nodes: 0 };
-        const carried = encodeValue(one.before, [], 0, [], fault);
-        if (fault.found !== null) throw fault.found;
-        Reflect.apply(addon_.write, instance, [
-          encodeAddress(one.address, undefined, 'first argument'),
-          encodeTier('mem', true, false, 'first argument'),
-          carried,
-        ]);
-      }
+    const key = homeAddressKey(one.address);
+    if (hasOwnSpelling(measured, key) === true) continue;
+    appendOwn(measured, key);
+    // **THE ADDRESS IS READ AGAIN, AGAINST THE CAPTURE** — the cross-tier standing and every tier with its own
+    // value — and it counts as restored ONLY where both equal what the watch took before the reversal.
+    const verdict = standingVerdict(instance, one);
+    if (stateRestored && verdict.exact === true) {
       restored += 1;
-    } catch (refused) {
-      // A RESTORE THAT COULD NOT BE TAKEN IS NOT SWALLOWED: the address is named in the refusal's log, so the
-      // consumer is never told the store was put back when it was not.
-      appendOwn(failed, one.address);
+      continue;
+    }
+    // AN ADDRESS THAT DOES NOT STAND AGAIN IS NAMED, WITH WHAT STANDS THERE INSTEAD AND WHAT IT WAS OWED, so the
+    // consumer is never told the store was put back when it was not.
+    appendOwn(failed, {
+      address: one.address,
+      before: one.before,
+      beforeTier: one.beforeTier,
+      beforeTiers: one.beforeTiers,
+      standing: verdict.value,
+      tiers: verdict.tiers,
+    });
+  }
+  return { restored, total: measured.length, failed, refused, unsaved, cacheless };
+}
+
+/// **WHETHER A LOCAL LIST OF SPELLINGS ALREADY HOLDS ONE** — a local index loop and not `Array.prototype.includes`.
+function hasOwnSpelling(spellings, spelling) {
+  for (let index = 0; index < spellings.length; index += 1) {
+    if (spellings[index] === spelling) return true;
+  }
+  return false;
+}
+
+/// **THE ADDRESS AS IT STANDS NOW, MEASURED AGAINST WHAT THE WATCH CAPTURED** — the check that turns "the
+/// restore ran" into "the restore LOOKED": the cross-tier standing, every tier that stands with its value, and
+/// `exact` only where the standing equals the captured one AND the tier set with its per-tier values equals the
+/// captured set. **A capture of no tier requires ABSENCE** (`value === undefined`), which is the state an
+/// address that stood at no tier is owed.
+function standingVerdict(instance, one) {
+  const value = standingAt(instance, one.address);
+  const tiers = [];
+  for (let index = 0; index < STANDING_TIERS.length; index += 1) {
+    const tier = STANDING_TIERS[index];
+    const stood = standingAtTier(instance, one.address, tier);
+    if (stood.stood === true) appendOwn(tiers, { tier, value: stood.value });
+  }
+  if (one.beforeTiers.length === 0) {
+    return { exact: value === undefined && tiers.length === 0, value, tiers };
+  }
+  if (sameStanding(value, one.before) === false) return { exact: false, value, tiers };
+  if (tiers.length !== one.beforeTiers.length) return { exact: false, value, tiers };
+  for (let index = 0; index < tiers.length; index += 1) {
+    if (tiers[index].tier !== one.beforeTiers[index].tier) return { exact: false, value, tiers };
+    if (sameStanding(tiers[index].value, one.beforeTiers[index].value) === false) {
+      return { exact: false, value, tiers };
     }
   }
-  return { restored, total: moved.length, failed };
+  return { exact: true, value, tiers };
 }
 
 /// **THE SENTENCE THE LOG CARRIES ABOUT THE UNDOING** — the refusal's own record of the compensating act, read
-/// at the ONE site that builds the log entry. It names the act and, where a restore could not be taken, the
-/// addresses still standing at the state the judgement refused (`DEF-Q`: no column prints `undefined`).
+/// at the ONE site that builds the log entry. **IT MAY CLAIM *"THE REVERSAL WAS UNDONE"* ONLY WHERE EVERY ADDRESS
+/// IT MOVED STANDS AGAIN EXACTLY AS IT STOOD** (`restoreReversal`'s verdict); where it cannot, **it names each
+/// address that could not be restored and says what stands there INSTEAD and what it was owed** (`D-41` item `2`:
+/// *"a message must not claim a restoration that did not happen"*). `DEF-Q`: no column prints `undefined`.
+///
+/// **⟶ AND THE TWO ARMS THE STORE CAN ANSWER WITH ARE NAMED SEPARATELY, 2026-10-27 (THE FILE-SAVE RULING).**
+/// **A REFUSED MARK** means the store holds what it held, and the sentence says exactly that. **A FAILED SAVE
+/// does not mean that**: the store's replay ran, every address the restore moved IS restored in memory, and the
+/// one thing that failed is the write of the bytes at the store's file path. **So the sentence opens by saying
+/// BOTH — the in-memory state was restored and the bytes were not updated — carries the store's own
+/// `FileCommitFailed` and its generated message (`DD-52`: never a second source), and then makes the ordinary
+/// claim the verification supports.** A consumer that reads only the first clause of this sentence therefore
+/// learns the two facts the failure owes it, in the order that matters.
 function undoSpelling(undo) {
+  // **⟶ AND WHERE THE STORE ITSELF REFUSED THE MARK, THE SENTENCE OPENS WITH THAT** (2026-10-27): the act is the
+  // store's own (`restoreReversal`), so a refusal it answered is the FIRST thing a consumer must hear — its
+  // status and its own generated message (`DD-52`) — and it is never spoken for by a claim about the state.
+  let refusal = '';
+  if (undo.cacheless === true) {
+    // **⟶ AND THE CACHELESS ARM OPENS THE SENTENCE, 2026-10-27** (`restoreReversal` above): **a window with no
+    // cached journal mark is a window that never opened, and the act refused rather than falling back to the
+    // head.** No status is named — no store verb was reached and none refused — and the one fact a consumer must
+    // hear is that nothing was restored, which is what the count below then spells address by address.
+    refusal = 'the commit window this reversal ran in carries NO CACHED JOURNAL MARK, so the store was NOT asked '
+      + 'to restore it and holds the state the reversal left; ';
+  } else if (undo.unsaved !== null && undo.unsaved !== undefined) {
+    // THE SAVE'S ARM: read as own data members and off no chain (`D-35`'s read half), exactly as the refused
+    // mark's status and sentence are read below.
+    const carried = typeof undo.unsaved === 'object';
+    const status = carried === true ? ownDataMember(undo.unsaved, 'status') : undefined;
+    const said = carried === true ? ownDataMember(undo.unsaved, 'message') : undefined;
+    refusal = 'the store restored its own state to the journal mark IN MEMORY and its FILE WAS NOT UPDATED ('
+      + `${JSON.stringify(typeof status === 'string' ? status : 'a refusal')}: `
+      + `${typeof said === 'string' ? said : ''}) — the bytes at the store's file path still describe the state `
+      + 'that stood before the reversal; ';
+  } else if (undo.refused !== null && undo.refused !== undefined) {
+    // READ AS OWN DATA MEMBERS AND OFF NO CHAIN (`D-35`'s read half): the store's own plain refusal carries
+    // `{status, message}` and nothing else, and a thrown value that is not an object is named as itself.
+    const carried = typeof undo.refused === 'object';
+    const status = carried === true ? ownDataMember(undo.refused, 'status') : undefined;
+    const said = carried === true ? ownDataMember(undo.refused, 'message') : undefined;
+    refusal = `the store REFUSED the journal mark (${JSON.stringify(typeof status === 'string' ? status : 'a refusal')}`
+      + `: ${typeof said === 'string' ? said : ''}) and holds the state it held; `;
+  }
   if (undo.failed.length === 0) {
-    return 'the reversal was UNDONE: every address it moved stands again at its pre-reversal state';
+    return `${refusal}the reversal was UNDONE: every address it moved stands again exactly as it stood before `
+      + 'the reversal — the same value at the same tier, or absent where it was absent';
   }
   let named = '';
   for (let index = 0; index < undo.failed.length; index += 1) {
-    named += index === 0 ? addressSpelling(undo.failed[index]) : `, ${addressSpelling(undo.failed[index])}`;
+    const one = undo.failed[index];
+    named += index === 0 ? '' : '; ';
+    named += `${addressSpelling(one.address)} could not be restored and stands `
+      + `${standingDescription(one.standing, one.tiers)} where it stood `
+      + `${capturedDescription(one)} before the reversal`;
+  }
+  const moved = undo.total === 1 ? 'address' : 'addresses';
+  const still = undo.restored === 1 ? 'stands' : 'stand';
+  return `${refusal}the reversal was NOT undone at every address it moved (${undo.restored} of the `
+    + `${undo.total} ${moved} it moved ${still} again): ${named}`;
+}
+
+/// **A STANDING AS A SENTENCE — WHAT VALUE, AT WHICH TIER, OR ABSENCE** (`DEF-Q`: no column prints `undefined`).
+function standingDescription(value, tiers) {
+  if (tiers.length === 0) {
+    return value === undefined
+      ? 'at no value and no tier (absent)'
+      : `at the value ${standingSpelling(value)} and at no tier this act can name`;
+  }
+  let spelled = 'at ';
+  for (let index = 0; index < tiers.length; index += 1) {
+    spelled += index === 0 ? '' : ' and ';
+    spelled += `tier \`${tiers[index].tier}\` holding ${standingSpelling(tiers[index].value)}`;
+  }
+  return spelled;
+}
+
+/// **THE CAPTURED STANDING AS THE SAME SENTENCE — what the address was owed**, tier by tier with each tier's own
+/// value (so a shadow's two versions are both named and neither is spoken for the other). **AND WHERE IT STOOD
+/// AT MORE THAN ONE TIER, THE TIER THE CROSS-TIER READ DREW FROM IS NAMED BESIDE THEM** — the watch's
+/// `beforeTier`, which is what the consumer's own `read` would have answered at that instant.
+function capturedDescription(one) {
+  const tiers = one.beforeTiers;
+  if (tiers.length === 0) return 'at no value and no tier (absent)';
+  let spelled = 'at ';
+  for (let index = 0; index < tiers.length; index += 1) {
+    spelled += index === 0 ? '' : ' and ';
+    spelled += `tier \`${tiers[index].tier}\` holding ${standingSpelling(tiers[index].value)}`;
+  }
+  if (tiers.length > 1) {
+    spelled += ` (the cross-tier read answered tier \`${one.beforeTier}\`)`;
   }
-  return `the reversal was NOT undone at every address it moved: ${named} stand at the state this `
-    + 'judgement refused';
+  return spelled;
 }
 
 
@@ -1369,6 +2111,22 @@ function standingAt(instance, address) {
   }
 }
 
+/// **THE STORE'S STANDING AT ONE ADDRESS NARROWED TO ONE TIER — THE SAME ROUTE, ONE ARGUMENT FURTHER** (the
+/// `read` member's declared tier position, `a.read(address, tier?)`; `src/args.rs`'s `read_tier_sel` admits ONE
+/// token and answers that tier's version). **`stood: false` is the tier's own absence** — `TierNotFound` where
+/// the key holds no version at that tier, `AddressNotFound` where it holds none at all — and **`stood: true` with
+/// the value is what that tier answers**, which is the capture a tier-exact restore writes back.
+///
+/// **AND THE REFUSAL'S OWN CODE IS NOT READ HERE**: a tier probe asks one question — does this tier stand? — and
+/// every refusal to it answers the same thing, so no code is put in a value slot on this path (`DD-12`).
+function standingAtTier(instance, address, tier) {
+  try {
+    return { stood: true, value: instance.read(address, tier) };
+  } catch (refused) {
+    return { stood: false, value: undefined };
+  }
+}
+
 /// **WHETHER TWO STANDINGS ARE THE SAME STATE** — the comparison the word "touched" is decided by. **IT IS
 /// STRUCTURAL AND IT IS TAKEN ON THE STORE'S OWN DECODED VALUES**, which the crossing admits as JSON values
 /// (`docs/specs/storeroom-json-crossing/`): `Object.is` for the primitives, then `length` and index for the
@@ -1415,11 +2173,26 @@ function ownDataMember(value, name) {
 /// **A BODY THAT THROWS IS THE SURFACE'S RANK-`18` `ConstraintBodyThrew`, NOT A RAW HOST ERROR** (`DEF-S`'s
 /// ruling, `D-38`; `src/error.rs`'s `[&str; 20]` rank `18`): the mark the kernel sets at its own three frames
 /// (`markBodyThrow`) is spelled on this side under the same `Symbol.for` key — so the value crosses through
-/// `bodyThrowRefusal` and this surface's ONE form, with `log: []` (no attempt stands at a reversal's
-/// judgement). **WHERE THE TREE CARRIES NO USABLE GENERATOR THE BODY'S OWN VALUE CROSSES AS ITSELF**, which is
-/// the safe direction `registrationCrossing` already takes and the one `fail-surface.md §1.1` item 5 declares
-/// for a body's throwable.
-function reversalOutcome(entry, address, value) {
+/// `bodyThrowRefusal` and this surface's ONE form. **WHERE THE TREE CARRIES NO USABLE GENERATOR THE BODY'S OWN
+/// VALUE CROSSES AS ITSELF**, which is the safe direction `registrationCrossing` already takes and the one
+/// `fail-surface.md §1.1` item 5 declares for a body's throwable.
+///
+/// **⟶ AND THE THROWN VALUE NO LONGER ESCAPES THE JUDGEMENT UNCOMPENSATED, 2026-10-27 (`D-41` item `4`;
+/// ANNOTATE-BESIDE).** The clause above read *"with `log: []` (no attempt stands at a reversal's judgement)"*,
+/// and the throw then propagated out of `judgeReversal` **with the reversal's effect standing and `log` `[]`** —
+/// measured: the store held the state nobody could judge and the consumer was told nothing had been undone. **The
+/// conversion here is unchanged and is the CATCHER'S**: `judgeReversal` catches what this function throws (the
+/// converted rank-`18` form, or the body's own value where no generator stands), restores, and refuses with a log
+/// that names this pair — so the empty log this clause named as the arm's fact is superseded by the judgement's
+/// own arm, and no byte of the conversion moves.
+///
+/// **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A pair's constraint
+/// body is EXTERNALLY-SUPPLIED FUNCTION code entering the surface **and it has no commit to name** — its
+/// five-member context carries none (`kernel-surface.md §2.3` item 1) — so **a verb the body calls OPENS ITS OWN
+/// COMMIT** rather than joining the commit the reversal is being judged inside. **THE CONTEXT IS BUILT ABOVE THE
+/// INVOCATION**, so the store read the context owes is this frame's act and not the body's, and the conversion
+/// below is unchanged.
+function reversalOutcome(instance, entry, address, value) {
   const context = {
     address: address.slice(),
     tier: null,
@@ -1428,7 +2201,7 @@ function reversalOutcome(entry, address, value) {
     op: null,
   };
   try {
-    return entry.fn(context);
+    return externalCall(instance, () => entry.fn(context));
   } catch (body) {
     const carried = Object.create(null);
     // THE TWO SLOTS THE KERNEL'S OWN MARK CARRIES (`kernel-foundations.mjs`'s `markBodyThrow`): the pair's
@@ -1456,50 +2229,109 @@ function reversalSaid(outcome) {
 /// GENERATED SENTENCE** at the pair's own `<SEGMENT>` slot (`addon_.errorMessage` — `DD-52` forbids a second
 /// source, so nothing is authored here; the fixed sentence below is reached only on a tree whose generator is
 /// unusable, which is the same arm `constraintCrossing` answers with a fixed sentence), **and THE `log` IS ONE
-/// `constraint-check` ENTRY OF THE KERNEL'S SIX MEMBERS NAMING THE CONSTRAINT AND THE STATE IT REFUSED.**
+/// `constraint-check` ENTRY NAMING THE CONSTRAINT AND THE STATE IT REFUSED.**
 ///
 /// **THE ENTRY IS BUILT HERE AND NOT BY THE KERNEL, AND THE ODD MEMBER IS SAID PLAINLY: no attempt stands at
 /// a reversal's judgement**, so there is no attempt log to carry verbatim (`§2.5` item 3's `log` is *"the
-/// attempt's own message log"*). **The six members, their `constraint-check` kind and their `seq` ordinal are
-/// the kernel's own shape** (`kernel-surface.md §2.5` item 1, whose kind set is CLOSED and whose `state` is
-/// `null` on the three non-`outcome` kinds), so the entry is a log entry a consumer can already read and no
-/// SEVENTH member is minted.
-function reversalRefusal(one, after, said, reversalId, undo) {
+/// attempt's own message log"*).
+///
+/// **⟶ AND THE ENTRY CARRIES FIVE MEMBERS AND NOT SIX, 2026-10-27 — `D-41` ITEM `4`, ANNOTATE-BESIDE.** The
+/// clause above read *"The six members, their `constraint-check` kind and their `seq` ordinal are the kernel's
+/// own shape"* and the entry minted `seq: 1`; **THAT `1` WAS FABRICATED AND HAS NO RECORD BEHIND IT.** The
+/// kernel's `seq` is the ORDINAL WITHIN AN ATTEMPT'S OWN LOG (`kernel-foundations.mjs`'s `append`:
+/// `attempt.log.length + 1`, withdrawn entries renumbered) — **and no attempt stands at a reversal's judgement,
+/// so there is no log whose ordinal this is and no member of any record here that it could be read from.**
+/// `contract.md §2.6` item 4's clause of 2026-10-26 declared the `1`; **this pass does not mint it.** The entry
+/// therefore carries the other five members — `kind` · `id` · `message` · `opId` · `state` — and **no `seq` at
+/// all**: the honest form of a record whose ordinal is unknown is an absent member, never a number invented for
+/// it (`D-21`: a member that did not stand says so).
+///
+/// **AND IT HAS A SECOND ARM — THE JUDGEMENT THAT COULD NOT COMPLETE (`D-41` item `4`).** Where `thrown` is the
+/// value a pair's body threw at this judgement, the entry is the same five-member `constraint-check` naming the
+/// same pair, the state the reversal left and the undoing, **and the crossed `status` is the set's rank-`18`
+/// member `ConstraintBodyThrew` with the store's own sentence for it** — the code says what happened (a body
+/// threw), while the treatment is the violation arm's: the reversal was restored and the pair is named.
+/// **WHERE THE THROWN VALUE IS NOT THE KERNEL'S MARKED FORM** (a body's raw throwable on a tree with no usable
+/// generator), the same rank-`18` refusal is built here — the restoration and the pair's name cross regardless
+/// of the body's own value's class, which is the difference between a compensating act and a conversion.
+function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled = false) {
   const addon_ = withAddon();
   // **THE `<SEGMENT>` SLOT IS THE ADDRESS SPELLING THE KERNEL'S OWN REGISTRATION REFUSAL HANDS THE SAME
   // GENERATOR** (`kernel-registration.mjs`'s `registrationRefusal`: the segments joined by `/`, BARE — the
   // generator's own `build` is what prints a string segment single-quoted, so a pre-quoted spelling here
   // would print `''a''`). One spelling, one home, and no second quoting rule.
   const subject = addressSpelling(one.address);
+  // **⟶ AND THE UNQUIET ARM KEEPS THE SAME CROSSED STATUS, `D-42` (2026-10-27).** A restart that spends its
+  // budget has not been JUDGED — it could not settle — and **a check that will not settle is a check that does
+  // not pass** (`D-41` item `4`'s own direction), so the status is the set's rank-`20` member for a refused
+  // pass, exactly the one the at-rest control crosses with. **ONLY THE LOG ENTRY'S SENTENCE DIFFERS**, so that
+  // no consumer is told a pair refused a state it never got to judge.
+  const status = thrown === null ? CONSTRAINT_PASS_REFUSED : BODY_THREW_STATUS;
   let message = '';
   if (typeof addon_.errorMessage === 'function') {
-    const generated = addon_.errorMessage(CONSTRAINT_PASS_REFUSED, subject, 'constraints');
-    if (typeof generated === 'string') message = generated;
+    const generated = addon_.errorMessage(status, subject, 'constraints');
+    if (typeof generated === 'string' && generated.length > 0) message = generated;
   }
   if (message === '') {
-    message = 'the reversal was refused by a constraint pass, the state it would leave is not one the '
-      + 'registered constraints admit';
+    message = thrown === null
+      ? 'the reversal was refused by a constraint pass, the state it would leave is not one the registered '
+        + 'constraints admit'
+      : 'the reversal was refused by a constraint body that threw, the state it would leave could not be judged';
+  }
+  // **THE LOG ENTRY'S SENTENCE, AT ITS THREE ARMS** — a pair that refused the state the reversal (or the
+  // in-commit action) left, a body that threw at the judgement of it, and — from `D-42` — **the restart's own
+  // budget spent**. The third arm is the one the restart's exhaustion reaches and it names no refusing pair.
+  let spelled;
+  if (unsettled === true) {
+    spelled = `the constraint ${one.entry.id} could not be asked a state that would settle at `
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — the check was `
+      + `restarted ${RESTART_LIMIT} times and a pair body acted inside the check at every restart, so the `
+      + `restart budget is spent and the check does not pass — ${undoSpelling(undo)}`;
+  } else if (thrown === null) {
+    spelled = `the constraint ${one.entry.id} refused the state the reversal left at `
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
+      + (said === null ? '' : ` — ${said}`)
+      + ` — ${undoSpelling(undo)}`;
+  } else {
+    spelled = `the constraint ${one.entry.id} THREW at the judgement of the state the reversal left at `
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
+      + ` — ${undoSpelling(undo)}`;
   }
   const entry = {
-    seq: 1,
+    // **⟶ AND THE `seq` STANDS, 2026-10-28 — `DEF-AI`: THE ENTRY'S DECLARED SHAPE IS THE KERNEL'S CLOSED SIX
+    // AND THIS ONE CARRIED FIVE.** The 2026-10-27 clause below withdrew the `1` as FABRICATED, on the reading
+    // that `seq` is *"the ordinal within an ATTEMPT's own log"* and that no attempt stands at a reversal's
+    // judgement. **THE READING IS RIGHT ABOUT THE ATTEMPT AND WRONG ABOUT THE MEMBER.** `seq`'s DECLARED
+    // DOMAIN is *"the append ordinal, strictly increasing from `1` in array order"*
+    // (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1), and the array this entry stands in is
+    // THIS REFUSAL'S OWN ONE-ENTRY LIST: its first element's ordinal is `1` BY THAT RULE, not by invention —
+    // the same arithmetic the kernel's own `append` performs (`log.length + 1`, read off the list the entry
+    // stands in). **AND THE TWO COPIES OF THIS VERY ENTRY ALREADY DISAGREED**: `carryRestartRefusal` re-appends
+    // it into the attempt's log through `append`, where it carries `seq` `1`, while the list that crosses to
+    // the caller carried none — one entry, two shapes, which is this branch's `DEF-AI` class exactly. **`log`
+    // IS DECLARED `LogEntry[]`** (`bindings/js/index.d.ts`), so a consumer typing it read `undefined` where
+    // `number` is declared. **THE DECLARATION IS NOT WEAKENED TO MATCH THE ENTRY: THE ENTRY CARRIES THE
+    // MEMBER.** No other member, no second entry and no sentence moves.
     kind: 'constraint-check',
+    seq: 1,
     id: one.entry.id,
-    // **⟶ AND THE ENTRY SAYS THE REVERSAL WAS UNDONE, 2026-10-26 (`DEF-W`'s `(a)`)** — the refusal's own
-    // record, beside the state it refused, so a consumer that catches it knows the store stands again where the
-    // reversal found it (and is told plainly where a restore could not be taken). ONE ENTRY, SIX MEMBERS: the
-    // sentence is this entry's, and no second log entry and no seventh member is minted.
-    message: `the constraint ${one.entry.id} refused the state the reversal left at `
-      + `${JSON.stringify(one.address)}: the value there is ${standingSpelling(after)}`
-      + (said === null ? '' : ` — ${said}`)
-      + ` — ${undoSpelling(undo)}`,
-    // **THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED, OR `null`** — the entry's sixth member is always
+    // **⟶ AND THE ENTRY SAYS WHAT THE ACT DID, 2026-10-26 (`DEF-W`'s `(a)`) and 2026-10-27 (`D-41` item `2`)** —
+    // the refusal's own record, beside the state it refused, so a consumer that catches it knows whether the
+    // store stands again where the reversal found it (and is told plainly, and by address, where it does not).
+    // ONE ENTRY, FIVE MEMBERS: the sentence is this entry's, and no second log entry and no sixth member is
+    // minted.
+    message: spelled,
+    // **THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED, OR `null`** — the entry's fifth member is always
     // present and of the kernel's own domain (`kernel-surface.md §2.5` item 1: a `string | null`), never absent.
     opId: typeof reversalId === 'string' ? reversalId : null,
     state: null,
   };
   const log = [];
   appendOwn(log, entry);
-  return { status: CONSTRAINT_PASS_REFUSED, message, log: refusalLog(log) };
+  // **THE CROSSED `status` IS THE ARM'S OWN AND IS NEVER MINTED** (`DD-40`): rank `20` where a pair refused the
+  // state the reversal left, rank `18` where a pair's body threw at the judgement of it (`D-41` item `4`). The
+  // sentence beside it was generated for that same code — one source for each (`DD-52`).
+  return { status, message, log: refusalLog(log) };
 }
 
 /// **THE ADDRESS'S OWN `<SEGMENT>` SPELLING, JOINED BY `/` AND BARE** — the kernel's own