provident-storeroom 1.0.1 → 1.2.0

package/src/entry/delivery.mjs

@@ -5,7 +5,8 @@ import { withAddon, boundaryReject } from './artefact.mjs';
 import { arrayClass, classSpelling, hasLoneSurrogate, isPlainObjectValue, targetSpelling } from './class-decision.mjs';
 import { encodeAddress, encodeOpId, handleWire, inDomainHandle } from './carrier.mjs';
 import { decodeSegments, spellConstraintAddress } from './frame.mjs';
-import { entryOf, carryRefusal, commitFile, homeAddressKey, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
+import { addressSpelling } from './kernel-foundations.mjs';
+import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
 
 /// `PAR-JS-13`: the returned record is `{op, watched, triggered}` — fresh on every call, never a view.
 ///
@@ -182,7 +183,21 @@ export function deliver(state, triggered, triggeringAddress) {
       // `crossing.md §1.1` clause 2's deep copy OUT, at the invocation: **each invocation is handed a FRESH
       // dense address array** (`JS-19`), so one listener's mutation of its own argument cannot be observed
       // by the next — no shared object crosses into the caller's own functions.
-      listener(decodeSegments(address));
+      //
+      // **⟶ AND THE INVOCATION NAMES NO COMMIT, 2026-10-27 — THIS IS THE SITE BOTH RULINGS ARE ABOUT.** **THE
+      // ARCHITECT, VERBATIM: *"A listener should be operating at the surface and opening a new commit"*** and
+      // *"how is a listener supposed to be able to reuse the outer verb's commit? The listener is an
+      // externally-passed function and should be making calls at the package surface. It should be opening a new
+      // commit by default of entering at the surface"*** (`strata/decisions.md` · `D-46` item `1`; `D-45`).
+      // **AND IT IS NOT AN EXCEPTION TO `D-46`'S RULE BUT ITS ABSENT ARM: A LISTENER BODY HAS NO COMMIT TO
+      // NAME** — it is handed the triggering address and nothing else (`PAR-JS-12`), so `externalCall` hands the
+      // channel no commit and **a verb it calls at this surface OPENS ITS OWN**: its check has a window of its
+      // own, the pairs standing over the addresses it writes to are asked by ITS pass, and the count rises by one
+      // for it and falls by one when it ends, **the outer verb's count unchanged across the call**
+      // (`tests/e2e/external-commit.test.mjs` prints both figures). **NOTHING IS INFERRED FROM THE FRAME ANY
+      // MORE**: the name is set here, restored when the body returns or throws, and every internal step of the
+      // listener's own write names the commit that write opened.
+      externalCall(state.receiver, () => listener(decodeSegments(address)));
     }
   }
 }
@@ -291,8 +306,8 @@ export function registerOn(state, handle, listener) {
   if (conflicted !== null) {
     boundaryReject(
       'AddressMalformed',
-      spellConstraintAddress(conflicted.address),
-      `the listener '${handle}' cannot be registered at ${JSON.stringify(conflicted.address)}: the constraint `
+      addressSpelling(conflicted.address),
+      `the listener '${handle}' cannot be registered at ${addressSpelling(conflicted.address)}: the constraint `
         + `'${conflicted.id}' stands at that address, and a listener and a constraint do not share one`,
     );
   }

package/src/entry/frame.mjs

@@ -2,6 +2,7 @@
 import { types } from 'node:util';
 import { boundaryReject } from './artefact.mjs';
 import { appendOwn } from './refusal.mjs';
+import { addressSpelling } from './kernel-foundations.mjs';
 import { arrayClass, classSpelling, hasLoneSurrogate, isAdmittedArray, isLawfulListenerElement, isPlainObjectValue, valueTargetSpelling } from './class-decision.mjs';
 import { encodeAddress, encodeFilePath, encodeJournalLength } from './carrier.mjs';
 
@@ -309,7 +310,7 @@ export function admittedConstraintBatch(cfg) {
         'ConstraintListInvalid',
         segment,
         `the batch element at position ${position} names the handle '${element.id}', and this construction `
-          + `adopts a listener under that handle at ${JSON.stringify(adoptedAddresses[adoptedAt])}: a listener `
+          + `adopts a listener under that handle at ${addressSpelling(adoptedAddresses[adoptedAt])}: a listener `
           + 'and a constraint do not share one',
         ['constraints'],
       );

package/src/entry/kernel-attempt.mjs

@@ -1,10 +1,125 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close } from './kernel-terminal.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-3` `runAttempt(store, commit) -> AttemptReport`
 // ---------------------------------------------------------------------------------------------
+/// **`D-44`'s CHANNEL, SPELLED ON THIS SIDE TOO** — `state.mjs`'s `installAttemptSeam` installs it and this
+/// module reads it, **and neither side imports the other**: the key is a `Symbol.for` spelling, the same device
+/// `SETTLED_ON_THE_PASSING_ARM`, `SAVE_FAILED_AT_THE_TERMINAL_ARM` and `TERMINAL_ARM` already cross this boundary
+/// by (`kernel-surface.md §1` item 1: this module's import footprint is EMPTY, so it cannot import `state.mjs`
+/// and must not).
+///
+/// **THE INVARIANT IS THE ARCHITECT'S, VERBATIM: *"There should be no state where a constraint is being checked
+/// without an open commit. Any action that would cause a constraint check should open a commit before
+/// beginning"*** (`strata/decisions.md` · `D-44`) — **and it is enforced HERE, at the one frame where a check
+/// runs, and not at the frame that called it**: a bracket taken in `constraintWrite` would be bypassed by every
+/// direct `K-2`/`K-3` drive, and *"a seam a driver can bypass is not an invariant."*  **SO THE PASS OPENS ITS OWN
+/// SCOPE, AND A STORE THAT CARRIES NO CHANNEL IS REFUSED RATHER THAN RUN UNCOMMITTED** — the invariant fails
+/// closed, `KC-2` (the kernel's own argument token, the one its other two store-mismatch arms answer with; no
+/// ninth token is minted, `fail-surface.md §2`).
+const COMMIT_SCOPE = Symbol.for('provident-storeroom.commit-scope');
+
+/// **⟶ `D-42`'s RESTART CONSUMER, REACHED ON THE SAME SEAM AND INSIDE THE SAME SCOPE — 2026-10-27.**
+///
+/// **`D-44`'s OWN TERMS DECLARED THIS OWED AND ITS IMPLEMENTATION DID NOT DELIVER IT**: *"If every check has a
+/// commit, every request has a consumer, and the consumer stops being a property of one call site."* **The
+/// request was still consumed by `constraintWrite`'s frame**, so a constraint body's `rollback` inside a pass
+/// driven straight through `K-2`/`K-3` — the window `D-44` itself emptied — raised a request no frame above it
+/// would ever consume, and the pair the reversal invalidated was never asked at the state the action left.
+///
+/// **THE REQUEST IS A STORE-SIDE FACT, SO ITS CONSUMER IS THE STORE'S OWN COMMIT SCOPE — ONE MECHANISM, NOT
+/// TWO.** `runAttempt` is, since `D-44`, THE universal caller of a pass (every check runs inside its scope), so
+/// it is the one frame every driver reaches; after its pass it asks the store to drain what the pass recorded,
+/// **inside the scope it already owns** — so the restarted check is itself a check with a commit open.
+/// **THE CHANNEL IS A `Symbol.for` KEY** (`state.mjs` installs it; this module spells it and imports nothing of
+/// the entry — `kernel-surface.md §1` item 1's empty import footprint), **and NO KERNEL ITEM IS MINTED**
+/// (`§1` item 2: `K-1`–`K-5` and no sixth name).
+const RESTART_DRAIN = Symbol.for('provident-storeroom.restart-drain');
+
+/// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON AN INVOCATION'S OWN ENTRY, AND IT IS THIS PASS'S ONE USE OF THE
+/// SEAM'S SIXTH CHANNEL.** **THE RULING, THE ARCHITECT, VERBATIM: *"A constraint's repair needs to stay as part
+/// of the same commit so that it can be tracked as part of the commit process … The original way of maintaining
+/// this was to accept an optional parameter on entry for the commit id, so that a constraint can identify which
+/// open commit it is repairing"*** (`strata/decisions.md` · `D-46`). **SO THE KERNEL NAMES THE ATTEMPT'S COMMIT
+/// WHEN IT INVOKES A REPAIR**, and the write that repair body makes — at `write`'s THREE positions, supplying
+/// nothing — **JOINS the attempt's commit instead of opening a second one**: its op is the attempt's op, the
+/// attempt's log carries the `repair-run` entry naming it, and **`attempt-opened` fires no second time for it,
+/// because a repair is not a new act** (`tests/e2e/repair-in-commit.test.mjs` prints both).
+///
+/// **AND THE TWO HALVES `D-45` MARKED AS OWNERS ARE UN-MARKED HERE, BY NAME**: this file's arm (b) and
+/// `kernel-registration.mjs`'s state `3` invoked the repair body through the entry's `externalCall`, which names
+/// nothing and is therefore the OPENS arm; the body is now reached through the channel with the commit at its
+/// second position. **A REPAIR IS NOT EXTERNAL CODE CLAIMING A COMMIT OF ITS OWN — IT IS PART OF THE ATTEMPT
+/// BEING TRACKED**, which is the one thing `D-45`'s authorship rule had wrong (`D-46` item `2`).
+///
+/// **THE KEY IS A `Symbol.for` SPELLING AND NEITHER SIDE IMPORTS THE OTHER** (`kernel-surface.md §1` item 1's
+/// empty import footprint; the device `COMMIT_SCOPE` and `RESTART_DRAIN` are declared under above), **NO MEMBER
+/// IS ADDED TO ANY RECORD AND NONE TO THE PRODUCT** (`A117` (D6)), and **no kernel item is minted** (`§1`
+/// item 2: `K-1`–`K-6` and no seventh name). **A STORE THAT CARRIES NO SUCH CHANNEL ANSWERS THE INVOCATION WITH
+/// NOTHING NAMED**, so the repair's write opens its own commit — the rule's absent arm and the conservative
+/// side, never a commit nobody named.
+const EXTERNAL_CALL = Symbol.for('provident-storeroom.external-call');
+
+/// **THE INVOCATION OF A REPAIR BODY, WITH THE ATTEMPT'S COMMIT NAMED ON ITS ENTRY** — one call, its answer the
+/// body's own, and a throwable crosses unchanged.
+function repairInCommit(store, commit, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run, commit);
+  return run();
+}
+
 export function runAttempt(store, commitRecord) {
+  // THE SEAM, READ BEFORE ANY STATE MOVES: **a store this package did not build carries no such channel, so it
+  // is not this package's store and no pass of this kernel may run against it.** The refusal is thrown BEFORE
+  // `status` moves, before an entry is appended and before a body is invoked, so a caller's attempt stands
+  // exactly as it stood and nothing is evaluated outside a commit.
+  const scope = store !== null && typeof store === 'object' ? store[COMMIT_SCOPE] : undefined;
+  if (typeof scope !== 'function') {
+    refuse(KC.arg,
+      'the store this constraint attempt would be run against carries no commit-scope channel, so there is no '
+        + 'open commit a constraint could be checked in',
+      []);
+  }
+  // **THE PASS, ITS WHOLE TERMINAL ACT AND THE RESTART, ALL TAKEN INSIDE THE ONE COMMIT WINDOW** — and the
+  // drain is reached ONLY where the pass answered a report: a failing pass throws out of the thunk below, so
+  // `D-42` item `2`'s *"the restart runs on the passing arm of the terminal call alone"* is now the shape of
+  // this function rather than a `catch` in a caller.
+  // **⟶ AND THE SCOPE IS HANDED THE PASS'S OWN COMMIT, 2026-10-27 (`D-46`): THE NAME IS THE RECORD `K-2` BUILT,
+  // so the pass's window JOINS the commit the attempt is tracked in** on the production path (the caller's
+  // `write` opened it and its kernel leg joined it) **and OPENS the one commit the pass owes** where nothing is
+  // open — a direct `K-2`/`K-3` drive, `D-44`'s window. **NO COUNT IS MINTED EITHER WAY**: the channel is
+  // `openCommit`/`closeCommit` composed, and the count moves only where this call's own opening is the one that
+  // took it.
+  return scope(() => {
+    const report = passInCommitScope(store, commitRecord);
+    return drainRestart(store, report);
+  }, commitRecord);
+}
+
+/// **THE DRAIN, TAKEN INSIDE THE SCOPE THE PASS JUST ENDED IN.** It hands the store **the report the pass
+/// answered with** and answers the report the kernel returns: unchanged where no request stood or the
+/// restarted check passed, and amended — `outcome` `'failed'` and the refusal's entry in the log — where the
+/// restarted check refused. **THE REFUSAL IS NOT THROWN OUT OF HERE**: it is a later check's, not this pass's,
+/// and a driver that is not the entry (a direct `K-3`) learns it from the report. `constraintWrite` — the
+/// entry — is the frame that refuses on the write's path, with the very value the report carries.
+///
+/// **A STORE THAT CARRIES NO DRAIN CHANNEL ANSWERS ITS REPORT UNCHANGED**, which is also a store no pass of
+/// this package could have raised a request on: the channel is installed by the same seam the scope above is.
+function drainRestart(store, report) {
+  const drain = store !== null && typeof store === 'object' ? store[RESTART_DRAIN] : undefined;
+  if (typeof drain !== 'function') return report;
+  return drain(report);
+}
+
+/// **THE PASS AND ITS WHOLE TERMINAL ACT, TAKEN INSIDE THE COMMIT WINDOW `D-44` REQUIRES.** The scope covers
+/// everything a check reaches — the landing's pass, every re-run, the residue's delivery and the `file`-tier save
+/// — so a body of a delivered set, a repair and a pair body are all invoked in a window. **ON THE PRODUCTION PATH
+/// THE SCOPE JOINS THE VERB'S OWN COMMIT AND MOVES NOTHING** (`state.mjs`'s `openCommit` answers `false` where the
+/// count already stands above zero, which is `§4.1`'s join rule); **on a DIRECT `K-2`/`K-3` DRIVE IT OPENS THE ONE
+/// THE PASS OWES AND CLOSES ONLY THAT**, so the state *"no open commit, one open attempt"* — `D-44`'s direct-pass
+/// window — no longer exists on any path.
+function passInCommitScope(store, commitRecord) {
   const kernel = kernelFor(store);
   const id = commitAttemptIdOf(commitRecord);
   const attempt = kernel.live.get(id);
@@ -29,7 +144,7 @@ export function runAttempt(store, commitRecord) {
   if (attempt.status === 'running') {
     // THE RE-ENTRANT `K-3`, refused by the SAME `KC-7` member a live address answers with.
     refuse(KC.attemptOpen,
-      `the constraint attempt at ${JSON.stringify(attempt.address)} is already running`, []);
+      `the constraint attempt at ${addressSpelling(attempt.address)} is already running`, []);
   }
 
   attempt.status = 'running';
@@ -127,7 +242,7 @@ export function runAttempt(store, commitRecord) {
     terminal(kernel, attempt, KC.violated,
       typeof saveFailure.message === 'string'
         ? saveFailure.message
-        : `the attempt's own save at ${JSON.stringify(attempt.address)} failed`);
+        : `the attempt's own save at ${addressSpelling(attempt.address)} failed`);
     throw saveFailure;
   }
   // **THE `commit` ENTRY: THE ATTEMPT'S SUCCESS ARM, APPENDED ONCE, ON THIS ARM ALONE**
@@ -143,7 +258,7 @@ export function runAttempt(store, commitRecord) {
   // before this line and reach this attempt's log by no act (`§2.7` item 6), the record this attempt's
   // report carries being the same list this line closes.
   append(attempt, 'commit', null, attempt.ops[attempt.ops.length - 1].opId,
-    `every constraint registered at ${JSON.stringify(attempt.address)} passed; the commit stands`);
+    `every constraint registered at ${addressSpelling(attempt.address)} passed; the commit stands`);
   return closed;
 }
 
@@ -272,7 +387,15 @@ function evaluate(kernel, attempt, landing) {
       const check = attempt.log[attempt.log.length - 1];
       let outcome;
       try {
-        outcome = pair.constraint(context);
+        // **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A constraint
+        // body is EXTERNALLY-SUPPLIED FUNCTION code entering the surface, **and it has no commit in hand to
+        // name** — it is handed the five-member `AttemptContext` and no commit at all (`kernel-surface.md §2.3`
+        // item 1) — so **a verb it calls OPENS ITS OWN COMMIT** rather than joining the one this pass runs in:
+        // *"It should be opening a new commit by default of entering at the surface"*. **THE NAME IS AN
+        // INVOCATION'S AND NOTHING ELSE'S**: it is set before the call and restored after it, on the throwing arm
+        // too, and the kernel's own acts of this pass name the pass's commit through `COMMIT_SCOPE` — so an
+        // ordinary write still opens ONE commit and a callback's verb is still an act of its own.
+        outcome = externalCall(attempt.store, () => pair.constraint(context));
       } catch (body) {
         // A body that threw returned nothing, so no `constraint-check` entry stands and the attempt is
         // closed (`PAR-C-6`; `NX-2`; `composition-and-states.md §2.7` item 13).
@@ -300,7 +423,7 @@ function evaluate(kernel, attempt, landing) {
       let text;
       let repair = null;
       if (outcome === true) {
-        text = `the constraint ${pair.id} passed at ${JSON.stringify(attempt.address)}`;
+        text = `the constraint ${pair.id} passed at ${addressSpelling(attempt.address)}`;
       } else if (outcome !== null && typeof outcome === 'object' && Object.hasOwn(outcome, 'message')) {
         const outcomeMessage = ownMember(outcome, 'message');
         text = typeof outcomeMessage === 'string' && outcomeMessage.length > 0
@@ -367,13 +490,12 @@ function evaluate(kernel, attempt, landing) {
       append(attempt, 'repair-run', pair.id, op.opId, 'the pair\'s repair was attempted');
       const entry = attempt.log[attempt.log.length - 1];
       let result;
-      try {
-        result = repair({
-          address: attempt.address.slice(),
-          id: pair.id,
-          op,
-          tier: context.tier,
-          value: context.value,
+      const repairContext = {
+        address: attempt.address.slice(),
+        id: pair.id,
+        op,
+        tier: context.tier,
+        value: context.value,
           // **⟶ ADDED 2026-10-15 (`surface.md §2.11` clause 6; the architect's ruling of 2026-10-15;
           // `kernel-surface.md §2.3` item 2).** **THE REPAIR IS PASSED THE COMMIT IT IS PART OF**, and it is
           // passed THE ONE OBJECT THIS CALL HANDS IT — the context itself — *"so that they can make their
@@ -394,7 +516,20 @@ function evaluate(kernel, attempt, landing) {
           // THE DECLARED FIVE IS MOVED**: `address` · `id` · `op` · `tier` · `value` stand as `§2.3` item 2
           // prints them, and the commit is carried beside them.
           pending: attempt.record === undefined ? [] : attempt.record.pending.slice(),
-        });
+      };
+      try {
+        // **⟶ RE-DERIVED 2026-10-27 — THE REPAIR BODY NAMES THE ATTEMPT'S COMMIT AND IS NO LONGER MARKED AS AN
+        // OWNER OF ITS OWN (`D-46` item `2`).** `D-45` invoked it through the entry's `externalCall`, so the
+        // write it made OPENED a second commit and the commit's own record no longer described the repair it
+        // performed. **THE RULING, VERBATIM: *"A constraint's repair needs to stay as part of the same commit so
+        // that it can be tracked as part of the commit process"*** — **so `repairInCommit` above hands the
+        // channel THE ATTEMPT'S OWN RECORD as the invocation's name, and the repair's write JOINS the commit it
+        // is part of.** **THE REPAIR'S CONTEXT CARRIES THAT SAME COMMIT AT ITS `pending` MEMBER** — the vehicle
+        // `surface.md §2.11` clause 6 declares, *"so that they can make their own write call use that commit"* —
+        // so a repair that supplies it at `write`'s fourth position names the same commit by its own hand, and
+        // the two spellings cannot disagree: **the entry's position wins where it is supplied, and this name is
+        // the fallback where it is not** (`state.mjs`'s `openCommit`).
+        result = repairInCommit(attempt.store, attempt.record, () => repair(repairContext));
       } catch (body) {
         // THE REPAIR-RUN ENTRY IS APPENDED BEFORE THE THROW, and the attempt's outcome entry carries
         // `KC-4` (`ck_states_a_repair_body_that_throws_reaches_the_caller_unconverted`).
@@ -477,7 +612,7 @@ function evaluate(kernel, attempt, landing) {
           : okMember === false
             && typeof messageMember === 'string' && messageMember.length > 0
             ? messageMember
-            : `the repair ${pair.id} produced no op at ${JSON.stringify(attempt.address)}`;
+            : `the repair ${pair.id} produced no op at ${addressSpelling(attempt.address)}`;
         entry.message = carried;
         return { terminal: { status: KC.repairFailed, message: carried }, rerun: false };
       }
@@ -622,6 +757,6 @@ function publishCheckedOff(attempt) {
  *  read off a member the row really holds, and no member of the sentence moves. */
 function unrecognized(pair) {
   return `the constraint ${pair.id} returned a value outside the three declared outcome arms at `
-    + `${JSON.stringify(pair.addresses[0])}`;
+    + `${addressSpelling(pair.addresses[0])}`;
 }
 

package/src/entry/kernel-commit.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9c`) — the commit act: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn } from './kernel-foundations.mjs';
+import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling } from './kernel-foundations.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-2` `commit(store, address, tier, value) -> CommitRecord`
 // ---------------------------------------------------------------------------------------------
@@ -20,7 +20,7 @@ export function commit(store, address, tier, value) {
   // HELD address WITHIN the instance is refused exactly as it stood. **THE ADDRESS COMPARISON ITSELF IS UNMOVED.**
   if (held && attemptHeldAt(kernel, address)) {
     refuse(KC.attemptOpen,
-      `a constraint attempt is already open at ${JSON.stringify(address)}; it is disposed of by its own `
+      `a constraint attempt is already open at ${addressSpelling(address)}; it is disposed of by its own `
       + 'K-3 and by no other act',
       []);
   }

package/src/entry/kernel-foundations.mjs

@@ -316,8 +316,32 @@ export function inDomainId(id) {
  * being the tuple.
  */
 export function pairSpelling(pair, address) {
-  return `${(address === undefined ? pair.addresses[0] : address).map((segment) => String(segment)).join('/')}`
-    + `#${pair.id}`;
+  return `${addressSpelling(address === undefined ? pair.addresses[0] : address)}#${pair.id}`;
+}
+
+/**
+ * **THE ADDRESS, SPELLED FOR THE KERNEL'S OWN SENTENCES — ONE RENDERING, DECLARED ONCE, AND THIS IS IT.**
+ *
+ * **`D-48`'s `DEF-AB` ROW IS THE MEASUREMENT THIS FUNCTION CLOSES: THE SAME ADDRESS WAS PRINTED TWO WAYS
+ * ACROSS TWO MESSAGES OF ONE RECORD.** `pairSpelling` above spells an address's segments joined by `/`
+ * (`a/b#x`); every other sentence the kernel built spelled the very same address through
+ * `JSON.stringify(address)` — `["a"]` — so one attempt's log carried *"the constraint `x` passed at
+ * `["a"]`"* beside *"the pair `a#x` violated a re-run …"*. **THE `DEF-Q` DEFECT CLASS AT ANOTHER SITE**, and
+ * the rendering that fixes it is the one `pairSpelling` already carried: **the address's segments joined by
+ * `/`, and never a JSON array.** There is now ONE spelling, ONE home, and both readers take it here.
+ *
+ * **IT TAKES THE SEGMENTS AS THE REGISTRY ROW AND THE JOURNAL OP CARRY THEM** — strings and non-negative
+ * integers — and renders a segment through `String` alone, exactly as `pairSpelling` always has: **no
+ * quoting, no bracketing and no second escaping rule is introduced, and no member of any sentence moves.**
+ * A local index loop is used, so no `Array.prototype.map`/`join` is read off a mutable prototype on a refusal
+ * path (`contract.md §2.1`'s clause of 2026-10-24 on `F7-1`).
+ */
+export function addressSpelling(address) {
+  let spelled = '';
+  for (let position = 0; position < address.length; position += 1) {
+    spelled += position === 0 ? `${String(address[position])}` : `/${String(address[position])}`;
+  }
+  return spelled;
 }
 
 /// **⟶ DELETED 2026-10-24 (`D-29`): `pairRowCarrying` HAD NO SUBJECT LEFT.** Its doc read: *"THE ROW A PAIR
@@ -478,6 +502,73 @@ export function kernelFor(store) {
   return kernel;
 }
 
+// ---------------------------------------------------------------------------------------------
+// ⟶ `D-45`'S MARKER, SPELLED ON THIS SIDE TOO — 2026-10-27
+//
+// **THE RULING IS THE ARCHITECT'S, VERBATIM: *"For 43, how is a listener supposed to be able to reuse the outer
+// verb's commit? The listener is an externally-passed function and should be making calls at the package
+// surface. It should be opening a new commit by default of entering at the surface"*** (`strata/decisions.md` ·
+// `D-45`). **SO A CALL ENTERING THE SURFACE FROM AN EXTERNALLY-SUPPLIED FUNCTION OPENS A NEW COMMIT BY DEFAULT,
+// AND ONLY THE PACKAGE'S OWN INTERNAL CONTINUATION JOINS.** The marker's implementation is `state.mjs`'s — the
+// depth, the per-window record and the join rule are that file's — and THIS module reaches it the way it reaches
+// every entry side: **a `Symbol.for` key, spelled on both sides, neither side importing the other**
+// (`kernel-surface.md §1` item 1's empty import footprint; `A110`; the same device `SETTLED_ON_THE_PASSING_ARM`,
+// `TERMINAL_ARM` and `COMMIT_SCOPE` cross this boundary by).
+//
+// **AND WHAT THIS MODULE OWES IT IS THE SITES: THE THREE FRAMES THAT INVOKE A CALLER-AUTHORED CONSTRAINT BODY**
+// (`registrationEvaluation`, `registrationRerun`, `kernel-attempt.mjs`'s `evaluate`) **AND THE ONE THAT INVOKES
+// A REPAIR BODY** (`kernel-attempt.mjs`'s arm (b) and `kernel-registration.mjs`'s state 3). **IT MARKS NOTHING
+// ELSE**: a store verb the kernel calls, a record it appends and a crossing it takes are the package's own acts
+// and run at the depth the enclosing commit was opened at, which is what keeps an ordinary write's count at
+// ONE for its whole length. **A STORE THAT CARRIES NO SUCH CHANNEL ANSWERS THE INVOCATION UNMARKED** (the
+// `state.mjs` fallback, byte for byte): a store this package never installed the seam on, whose call then joins
+// as it joined before `D-45` — the conservative side, and never a commit the mark did not ask for.
+//
+// **⟶ AMENDED 2026-10-27 — THE COMMIT A CALL NAMES DECIDES, AND AUTHORSHIP IS ONLY THE FALLBACK WHERE NONE CAN BE
+// NAMED (`D-46`).** **The clause above — *"A CALL ENTERING THE SURFACE FROM AN EXTERNALLY-SUPPLIED FUNCTION OPENS
+// A NEW COMMIT BY DEFAULT, AND ONLY THE PACKAGE'S OWN INTERNAL CONTINUATION JOINS"* — stands BYTE-FOR-BYTE and is
+// read THROUGH this one**, which states the operative rule and names the one sentence of that clause the shipped
+// tree no longer implements. **THE ARCHITECT, VERBATIM: *"A listener should be operating at the surface and opening a
+// new commit"* · *"A constraint's repair needs to stay as part of the same commit so that it can be tracked as
+// part of the commit process"* · *"The original way of maintaining this was to accept an optional parameter on
+// entry for the commit id, so that a constraint can identify which open commit it is repairing"***
+// (`strata/decisions.md` · `D-46`). **SO: A CALL THAT NAMES A COMMIT ON ITS OWN ENTRY JOINS THAT COMMIT, AND A
+// CALL THAT NAMES NONE OPENS A NEW ONE.** **THE POSITION IS `write`'s FOURTH**, whose domain is a RECORD (an object
+// carrying an own, present `pending`) and never an id token; **and where the package itself invokes caller code,
+// the name is the one that invocation was handed** (`state.mjs`'s `EXTERNAL_COMMIT`): **the kernel names the
+// attempt's commit when it invokes a REPAIR, and names nothing when it invokes a listener body or a constraint
+// body.** **AUTHORSHIP — THE MARK THIS BLOCK DECLARES — IS THE FALLBACK OF THE FALLBACK: it decides ONLY where
+// neither position stands** (`state.mjs`'s `openCommit` reads the entry's name first, the invocation's name
+// second, and the depth mark only where neither exists).
+//
+// **AND THE SITES SENTENCE ABOVE IS CORRECTED AT ITS REPAIR-BODY HALF, BY NAME.** The two frames that invoke a
+// REPAIR body — `kernel-attempt.mjs`'s arm (b) and `kernel-registration.mjs`'s state 3 — **NO LONGER CALL THIS
+// MODULE'S `externalCall`**: each reaches the same `Symbol.for` channel at its SECOND position with the attempt's
+// commit named (that file's own local `repairInCommit`, the same key spelled again), because **A REPAIR IS NOT AN
+// ACT AT THE SURFACE CLAIMING A COMMIT OF ITS OWN — IT IS PART OF THE ATTEMPT BEING TRACKED**, so the write its
+// body makes must join the attempt's window and the attempt's record must describe the repair it performed. **THE
+// THREE FRAMES THAT INVOKE A CALLER-AUTHORED CONSTRAINT BODY STILL CALL `externalCall`, WHICH NAMES NOTHING AND
+// IS THEREFORE THE OPENS ARM** (`registrationEvaluation`, `registrationRerun`, and `kernel-attempt.mjs`'s
+// `evaluate`), **and *"IT MARKS NOTHING ELSE"* STANDS**: what moved is the answer this module's one call site
+// gives, not the set of frames it is reached from. **A STORE THAT CARRIES NO SUCH CHANNEL STILL ANSWERS THE
+// INVOCATION UNMARKED** — `run()` at this frame, and a repair's own write then opening its own commit — which is
+// the rule's absent arm and never a commit nobody named.
+// ---------------------------------------------------------------------------------------------
+const EXTERNAL_CALL = Symbol.for('provident-storeroom.external-call');
+
+/// **THE INVOCATION OF A CALLER-SUPPLIED FUNCTION, THROUGH THE CHANNEL** — one argument, the thunk that makes
+/// the call; the answer is the invocation's own and a throwable crosses unchanged. **AND IT NAMES NO COMMIT, ON
+/// PURPOSE: A CALL THROUGH THIS HELPER IS `D-46`'S ABSENT ARM.** A caller-authored constraint body is handed a
+/// context carrying no commit (`kernel-surface.md §2.3` item 1) and a listener body is handed the triggering
+/// address and nothing else, so neither has a name to supply and the call opens its own commit. **A REPAIR is
+/// the one invocation that DOES have a name, and it is made by the invoking file's own channel call at the second
+/// position — never here** (`D-46` item 2; the amendment beside this block above).
+export function externalCall(store, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run);
+  return run();
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE LAWFUL APPEND — ADDED 2026-10-25 ON THE BLIND PASS'S `F8-2` WRITE VECTOR, AND IT IS A LOCAL COPY ON
 // PURPOSE: THIS MODULE'S OWN HEADER DECLARES AN EMPTY IMPORT FOOTPRINT (`§1` item 1; `A110`), so the kernel
@@ -636,7 +727,7 @@ export function landedOp(attempt, returned, invokedFor) {
  * — and never the attempt's address alone.
  */
 export function landedOpDefect(attempt, pair, returned) {
-  const where = JSON.stringify(attempt.address);
+  const where = addressSpelling(attempt.address);
   // **⟶ THE MEMBER IS READ AS THE RETURN'S OWN HERE TOO** (`D-35`'s read half): the arm that names *"carried no
   // op"* and the arm that spells the op must agree with `landedOp`'s own answer, and a chain read would let a
   // prototype decide which of the two sentences the caller is handed.

package/src/entry/kernel-registration.mjs

@@ -1,5 +1,36 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9b`) — the registration act, its evaluation, and the registry's removal: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsAtAddress } from './kernel-foundations.mjs';
+import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
+
+/// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON A REPAIR INVOCATION'S OWN ENTRY, SPELLED HERE AS
+/// `kernel-attempt.mjs` SPELLS IT.** **THE RULING, THE ARCHITECT, VERBATIM: *"A constraint's repair needs to stay
+/// as part of the same commit so that it can be tracked as part of the commit process … The original way of
+/// maintaining this was to accept an optional parameter on entry for the commit id, so that a constraint can
+/// identify which open commit it is repairing"*** (`strata/decisions.md` · `D-46`). **SO STATE `3`'S REPAIR NAMES
+/// THE SYNTHETIC ATTEMPT'S OWN COMMIT** — the record `3-bis` (a) declares *"the `CommitRecord` of the
+/// registration act"*, which is the same object the repair's context carries at its `pending` member — **and the
+/// write that repair body makes JOINS it instead of opening a second**: the op it lands is the synthetic
+/// attempt's op, and the commit the registration opened still describes the repair it performed.
+///
+/// **AND `D-45`'S MARKING OF THIS SITE IS UN-MARKED BY NAME.** This frame invoked the repair body through the
+/// entry's `externalCall`, which names nothing and is therefore the OPENS arm; `D-46` item `2` reverses it: **a
+/// repair is part of the attempt being tracked and is not external code claiming a commit of its own.**
+///
+/// **THE KEY IS A `Symbol.for` SPELLING AND NEITHER SIDE IMPORTS THE OTHER** (`kernel-surface.md §1` item 1's
+/// empty import footprint; the device `COMMIT_SCOPE` and `RESTART_DRAIN` cross by), **NO MEMBER IS ADDED TO ANY
+/// RECORD AND NONE TO THE PRODUCT** (`A117` (D6)), and **no kernel item is minted** (`§1` item 2). **A STORE THAT
+/// CARRIES NO SUCH CHANNEL ANSWERS THE INVOCATION WITH NOTHING NAMED**, and the repair's write opens its own
+/// commit — the rule's absent arm, never a commit nobody named.
+const EXTERNAL_CALL = Symbol.for('provident-storeroom.external-call');
+
+/// **THE INVOCATION OF A REPAIR BODY, WITH THE SYNTHETIC ATTEMPT'S COMMIT NAMED ON ITS ENTRY** — one call, its
+/// answer the body's own, and a throwable crosses unchanged. **THE SECOND COPY OF THE FIVE-LINE FORM
+/// `kernel-attempt.mjs` DECLARES**, because the two part files share no import and neither may reach the entry
+/// (`kernel-surface.md §1` item 1) or the other's private bytes.
+function repairInCommit(store, commit, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run, commit);
+  return run();
+}
 // ---------------------------------------------------------------------------------------------
 // `K-1` `register(store, address, id, constraint) -> Handle`
 // ---------------------------------------------------------------------------------------------
@@ -223,8 +254,15 @@ function registrationEvaluation(kernel, store, address, id, constraint) {
   // `registrationCrossing` converts A MARKED VALUE ONLY into this surface's one failure form, and an
   // unmarked throw is still the caller's own (`markBodyThrow`, `kernel-foundations.mjs`).
   let outcome;
+  const context = registrationContext(store, address, null);
   try {
-    outcome = constraint(registrationContext(store, address, null));
+    // **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A constraint body
+    // is EXTERNALLY-SUPPLIED FUNCTION code entering the surface **and it has no commit in hand to name** — its
+    // five-member context carries none (`kernel-surface.md §2.3` item 1) — so **a verb it calls OPENS ITS OWN
+    // COMMIT** rather than joining the registering verb's (*"It should be opening a new commit by default of
+    // entering at the surface"*). **THE CONTEXT IS BUILT ABOVE THE INVOCATION**, so the store read the context
+    // owes is this verb's own act and not the body's.
+    outcome = externalCall(store, () => constraint(context));
   } catch (body) {
     throw markBodyThrow(body, address, null);
   }
@@ -378,8 +416,19 @@ function registrationAttempt(kernel, store, pair) {
   append(attempt, 'repair-run', pair.id, null, 'the pair\'s repair was attempted at registration');
 
   let result;
+  const repairContext = registrationRepairContext(store, address, pair.id, attempt.commit);
   try {
-    result = pair.repair(registrationRepairContext(store, address, pair.id, attempt.commit));
+    // **⟶ RE-DERIVED 2026-10-27 — STATE `3`'S REPAIR NAMES THE SYNTHETIC ATTEMPT'S COMMIT AND IS NO LONGER
+    // MARKED AS AN OWNER OF ITS OWN (`D-46` item `2`).** `D-45` invoked it through the entry's `externalCall`,
+    // so the write it made OPENED a second commit and the registration act's own commit record no longer
+    // described the repair it performed. **THE RULING: *"A constraint's repair needs to stay as part of the same
+    // commit so that it can be tracked as part of the commit process"*** — so `repairInCommit` hands the channel
+    // **the record `3-bis` (a) declares as *"the `CommitRecord` of the registration act"***, **which is the very
+    // object `registrationRepairContext` copy-carries at the repair's `pending` member**: a repair that supplies
+    // that context at `write`'s fourth position names the same commit by its own hand, and the two spellings
+    // cannot disagree (the entry's position wins where it is supplied, and the invocation's name is the fallback
+    // where it is not — `state.mjs`'s `openCommit`).
+    result = repairInCommit(store, attempt.commit, () => pair.repair(repairContext));
   } catch (body) {
     // A REPAIR WHOSE BODY THROWS IS A FAILED REPAIR AND THE REGISTRATION IS REFUSED — the caller's act is
     // the registration, so the refusal is this module's one form (`3-bis` (d); the `KC` boundary at (e)).
@@ -444,14 +493,19 @@ function registrationRerun(kernel, attempt, produced) {
     const pair = kernel.pairs.get(key);
     if (pair === undefined) continue;
     let outcome;
+    const context = {
+      address: attempt.address.slice(),
+      tier: produced.tier === undefined ? null : produced.tier,
+      value: produced.after === undefined ? undefined : produced.after.value,
+      attempt: attempt.ref,
+      op: produced,
+    };
     try {
-      outcome = pair.constraint({
-        address: attempt.address.slice(),
-        tier: produced.tier === undefined ? null : produced.tier,
-        value: produced.after === undefined ? undefined : produced.after.value,
-        attempt: attempt.ref,
-        op: produced,
-      });
+      // **⟶ AND THIS BODY IS INVOKED WITH NOTHING NAMED TOO, 2026-10-27 (`D-45`, `D-46` item `1`)** — the
+      // re-run's frame is the third of the three that invoke a caller-authored constraint body, and it names no
+      // commit exactly as the registration evaluation and the landing's pass do. The context is built ABOVE the
+      // invocation.
+      outcome = externalCall(attempt.store, () => pair.constraint(context));
     } catch (body) {
       // **⟶ ADDED 2026-10-26 (`DEF-S`, the same ruling): a body thrown at the synthetic attempt's re-run is
       // marked at this frame too — the mark carries the attempt's own log and address, and the entry's