provident-storeroom 1.0.1 → 1.2.0

package/src/entry/state.mjs

@@ -109,6 +109,51 @@ export const FORGET_PAIR = Symbol.for('provident-storeroom.forget-pair');
 // COMMIT OPENS AND DECREMENTED ONCE ON THE FINAL RETURN TO THE CLIENT."* **A VERB THAT FINDS AN EXTANT
 // COMMIT JOINS IT RATHER THAN OPENING A SECOND**, which is what keeps the count exact under nesting.
 //
+// **⟶ AMENDED 2026-10-27, SECOND CLAUSE — THE DISCRIMINATOR IS THE COMMIT A CALL NAMES ON ENTRY AND IS NEITHER
+// DEPTH'S NOR AN AUTHORSHIP THE PACKAGE INFERS (`D-46`). THE CLAUSES ABOVE AND THE `D-45` ONE BELOW STAND
+// BYTE-FOR-BYTE AND ARE READ THROUGH THIS ONE.**
+//
+// **THE ARCHITECT, VERBATIM: *"A listener should be operating at the surface and opening a new commit"* · *"A
+// constraint's repair needs to stay as part of the same commit so that it can be tracked as part of the commit
+// process"* · *"The original way of maintaining this was to accept an optional parameter on entry for the commit
+// id, so that a constraint can identify which open commit it is repairing"*** (`strata/decisions.md` · `D-46`).
+//
+// **THE RULE, AS ONE SENTENCE: A CALL THAT NAMES A COMMIT ON ITS OWN ENTRY JOINS THAT COMMIT, AND A CALL THAT
+// NAMES NONE OPENS A NEW ONE.** **The position that carries the name is the `write` METHOD'S FOURTH** — the
+// commit, at the position `index.d.ts` declares (*"the commit, at the FOURTH position of the METHOD"*), which
+// takes a RECORD (an object carrying an own, present `pending`) and never an id token. **AND WHERE A CALL SITS
+// INSIDE AN INVOCATION THE PACKAGE ITSELF MADE OF CALLER CODE, THE NAME MAY COME FROM THE INVOCATION'S OWN
+// ENTRY** — see `EXTERNAL_COMMIT` below: **the kernel names the attempt's commit when it invokes a REPAIR, and
+// names nothing when it invokes a listener or a constraint body.** **A NAME IS NEVER INFERRED FROM A FRAME
+// COUNT, AN AUTHORSHIP MARK, A DEPTH OR A WINDOW, AND TWO NAMES CANNOT CONFLICT: THE ENTRY'S OWN POSITION WINS
+// AND THE INVOCATION'S IS ITS FALLBACK.**
+//
+// **WHY THE REPAIR JOINS AND THE LISTENER DOES NOT, IN THE ARCHITECT'S OWN TERMS.** A repair is **PART OF THE
+// ATTEMPT BEING TRACKED** — *"so that it can be tracked as part of the commit process"* — so its ops belong to
+// the attempt's commit and that commit's record describes the repair it performed; a listener body is
+// **externally-passed code operating at the surface**, so *"it's entering at the package surface"* and opens one
+// of its own (`D-43` item `1`, `D-45`), **and it has no commit in hand to name.** **THAT IS THE ONE CALLER THAT
+// CANNOT SUPPLY AN ID, AND IT IS THE RULE'S OWN ABSENT ARM RATHER THAN AN EXCEPTION TO IT.**
+//
+// **AMENDED 2026-10-27 — THE JOIN RULE IS NARROWED TO AUTHORSHIP AND IS NO LONGER DEPTH'S (`D-45`).**
+// The sentences above stand BYTE-FOR-BYTE and are read THROUGH this clause. **THE ARCHITECT, VERBATIM:
+// *"For 43, how is a listener supposed to be able to reuse the outer verb's commit? The listener is an
+// externally-passed function and should be making calls at the package surface. It should be opening a new
+// commit by default of entering at the surface"*** (`strata/decisions.md` · `D-45`). **THE RULE ABOVE WAS
+// WRITTEN FOR ONE CASE — THE PACKAGE'S OWN MACHINERY INSIDE ITS OWN VERB — AND IT CONFLATED THAT WITH
+// EXTERNAL RE-ENTRY**: *"a listener body, a constraint body"* is **A DIFFERENT ACT BY A DIFFERENT AUTHOR,
+// entering the package surface from outside, and it has no claim on the outer verb's commit at all.**
+// **SO: A CALL ENTERING THE SURFACE FROM AN EXTERNALLY-SUPPLIED FUNCTION OPENS A NEW COMMIT BY DEFAULT, AND
+// ONLY THE PACKAGE'S OWN INTERNAL CONTINUATION JOINS. THE DISCRIMINATOR IS AUTHORSHIP, NOT DEPTH.**
+//
+// **HOW AUTHORSHIP IS MEASURED, AND IT IS THE SECOND THING THE COUNT NEEDS.** `EXTERNAL_DEPTH` below is the
+// number of caller-supplied frames the package is, at this instant, running INSIDE; every window the index
+// opens records the depth it was opened at (`attemptIndex(...).externalAt`, in lockstep with `windows`).
+// **`openCommit` JOINS IFF THE CURRENT DEPTH IS NOT GREATER THAN THE DEPTH OF THE COMMIT IN FLIGHT** — so the
+// package's own continuation of that commit, which runs at the same depth, joins; **a call made from a
+// caller's function, which runs one frame deeper, opens.** **NO COUNT IS MINTED AND NO SECOND INDEX EXISTS**:
+// the mark is a depth and a per-window number, both of them this file's own.
+//
 // **AND ITS READER IS THE SEAM `§4.2` DECLARES**, reached as two `Symbol.for` channels ON THE STORE
 // INSTANCE — **NOT module exports of `constraint-kernel.mjs`**, whose export set a standing assertion
 // closes at the six `K-1`–`K-6` items (`§4.2` item 3; `implementation-plan.md §2` step `4`). **THE ROUTE
@@ -121,7 +166,137 @@ export const FORGET_PAIR = Symbol.for('provident-storeroom.forget-pair');
 const ATTEMPT_COUNT = Symbol.for('provident-storeroom.attempt-count');
 const ATTEMPT_OPENED = Symbol.for('provident-storeroom.attempt-opened');
 
-/** The per-store index: `{ open, observers }`, keyed by the store instance and by nothing else. */
+/// **⟶ ADDED 2026-10-27 — `D-44`'s ENFORCEMENT POINT: THE COMMIT SCOPE, AND IT IS THE SEAM'S THIRD CHANNEL.**
+///
+/// **THE RULING IS THE ARCHITECT'S, VERBATIM: *"There should be no state where a constraint is being checked
+/// without an open commit. Any action that would cause a constraint check should open a commit before
+/// beginning"*** (`strata/decisions.md` · `D-44`) — **and it is an INVARIANT, enforced WHERE THE CHECK RUNS and
+/// not at its callers**: *"a seam a driver can bypass is not an invariant."* `runAttempt` has ONE production
+/// call site (`constraints.mjs`'s `constraintWrite`) **and is also driven DIRECTLY by the batteries**, so a
+/// bracket taken in the entry would be bypassed by every direct drive. **THE SCOPE IS THEREFORE OPENED BY THE
+/// PASS ITSELF**, and the kernel — which declares an EMPTY import footprint (`kernel-surface.md §1` item 1) and
+/// cannot import this module — reaches it through the seam `installAttemptSeam` already installs: the same
+/// `Symbol.for` device, a third channel on the object `storeCreate` returns.
+///
+/// **WHAT THE CHANNEL DOES, AND THE ONE RULE IT KEEPS**: `store[COMMIT_SCOPE](run)` runs the thunk `run` inside
+/// a commit window — **OPENING one if none is open, JOINING the extant one if one is, and CLOSING ONLY WHAT IT
+/// OPENED** (`openCommit` answers whether THIS call opened; `closeCommit` releases iff it did). **THAT IS
+/// `§4.1`'s OWN RULE** — *"a verb that finds an extant commit JOINS it rather than opening a second, which is
+/// what keeps the count exact under nesting"* — **so the production path's nesting is JOINED and never
+/// doubled**: the caller's verb bracket already holds the count at `1` and the pass's scope inside it moves the
+/// count by nothing. **A THROWABLE OUT OF `run` CROSSES UNCHANGED**, and the window is released on that arm
+/// too, so no count is ever left standing (`§5`'s failure list).
+///
+/// **NO MEMBER IS ADDED TO ANY RECORD AND NONE TO THE PRODUCT**: the channel is a `Symbol.for` key, invisible to
+/// `Object.keys` and to `Object.getOwnPropertyNames` (`A117` (D6)), so the product's declared own members are
+/// unmoved, no census of a `CommitRecord` moves and no kernel item is minted (`kernel-surface.md §1` item 2).
+const COMMIT_SCOPE = Symbol.for('provident-storeroom.commit-scope');
+
+/// **⟶ ADDED 2026-10-27 — `D-42`'s RESTART CONSUMER, AND IT NOW SITS WHERE THE SCOPE IS OWNED.**
+///
+/// **THE FINDING THIS CLOSES, SAID AS THE LAST PASS MEASURED IT** (`docs/specs/storeroom-js/contract.md §2.6`'s
+/// `D-44` annotate-beside, item `4`): *"a reversal issued INSIDE a directly driven pass is still neither judged
+/// nor restarted … the restart's consumer is the write's check path (`constraintWrite`'s
+/// `restartInvalidatedCheck`) and a directly driven pass has no such frame above it, so the request the body
+/// raises dies with its window."* **`D-44` gave every check an open commit and stopped there**; the request a
+/// check's own body raises was still consumed by ONE call site (`constraintWrite`), which is a property of a
+/// caller and not of the check. **So the consumption moves to the frame that owns the scope — `runAttempt` —
+/// and the store reaches its consumer by a fifth `Symbol.for` channel on this same seam.**
+///
+/// **THE CHANNEL IS THE SAME DEVICE AS THE SCOPE ABOVE**: installed once by `installAttemptSeam`, invisible to
+/// `Object.keys` and `Object.getOwnPropertyNames` (`A117` (D6)), no member added to any record and none to the
+/// product, and no kernel item minted (`kernel-surface.md §1` item 2: `K-1`–`K-5` and no sixth name). **Its one
+/// argument is the closed `AttemptReport` the pass answered with**, and its answer is the report the kernel
+/// returns: the consumer may leave it untouched (no request stood, or the restarted check passed) or answer it
+/// amended (the restarted check refused). **ITS IMPLEMENTATION IS THE ENTRY'S AND IT IS INJECTED HERE**
+/// (`installRestartConsumer` below): this module may not import `constraints.mjs` — `constraints.mjs` imports
+/// this one, and `kernel-attempt.mjs` imports neither — so the restart machinery stays in its own file and only
+/// the CHANNEL is declared on the seam.
+///
+/// **AND IT RUNS INSIDE THE PASS'S OWN SCOPE**: `runAttempt` calls it after its pass and before the scope is
+/// released, so the restarted check is a check with a commit open — `D-44`'s invariant reaches the restart
+/// itself, which it could not while the consumer was a frame outside the scope.
+const RESTART_DRAIN = Symbol.for('provident-storeroom.restart-drain');
+
+/// **THE RESTART'S ONE IMPLEMENTATION, INJECTED BY THE FILE THAT OWNS IT** — `constraints.mjs` calls
+/// `installRestartConsumer(drainRestartRequests)` at its own module scope. **A NULL SLOT IS A STORE WITH NO
+/// RESTART MACHINERY AND ITS PASS ANSWERS ITS REPORT UNCHANGED** — a request can only be raised by a pair, a
+/// pair is only carried by `constraints.mjs`, and a tree that never loads that file has no request to consume.
+let RESTART_CONSUMER = null;
+export function installRestartConsumer(consumer) {
+  RESTART_CONSUMER = consumer;
+}
+
+/// **⟶ ADDED 2026-10-27 (`D-45`), RE-SPELLED 2026-10-27 (`D-46`) — THE SEAM'S SIXTH CHANNEL, AND IT CARRIES
+/// THE COMMIT AN INVOCATION OF CALLER CODE NAMES ON ITS OWN ENTRY.**
+///
+/// **WHAT IT CARRIES NOW, AND WHAT IT NO LONGER CARRIES.** `D-45` armed it with **A DEPTH** — the number of
+/// caller-supplied frames in flight — and `openCommit` compared that depth against the depth the commit in
+/// flight was opened at. **`D-46` REPLACES THE DEPTH WITH THE COMMIT ITSELF**: the second position holds **the
+/// commit the invocation names**, or `undefined` where the invocation names none, and **`openCommit` reads it as
+/// the name a call supplies when its own entry position carries none.** **THE DEPTH IS DELETED, NOT KEPT BESIDE
+/// IT** — one discriminator, stated once: **a call that names a commit JOINS it; a call that names none OPENS
+/// one** (`openCommit` below).
+///
+/// **WHICH INVOCATIONS NAME ONE, AND IT IS THE WHOLE OF `D-46`'s SECOND DIRECTION.** **A REPAIR NAMES THE
+/// ATTEMPT'S COMMIT** — *"A constraint's repair needs to stay as part of the same commit so that it can be
+/// tracked as part of the commit process"* — so the kernel hands the attempt's own record at the two frames that
+/// invoke a repair body (`kernel-attempt.mjs`'s arm (b) and `kernel-registration.mjs`'s state `3`), and the write
+/// a repair body makes **joins the attempt's commit by declaration**: its ops are the attempt's ops, its
+/// `repair-run` entry names the op it landed, and **no second commit opens for it** (`attempt-opened` stays at
+/// ONE for a write that repairs `tests/e2e/repair-in-commit.test.mjs` prints it). **A LISTENER BODY NAMES
+/// NOTHING, AND THAT IS NOT AN OMISSION: IT HAS NO COMMIT IN HAND TO NAME** — it is externally-passed code
+/// entering at the surface (`D-43` item `1`, `D-45`), so its call **OPENS ITS OWN** and the descendant window
+/// stays closed by construction (`tests/e2e/external-commit.test.mjs`, unchanged and green). **A CONSTRAINT
+/// BODY NAMES NOTHING EITHER**: it is invoked to be *asked*, not to act, so a verb it calls is a fresh act at the
+/// surface — the same reading `D-45` gave it.
+///
+/// **WHAT IT MARKS AND FOR HOW LONG**: one invocation of a caller-supplied function and nothing else. The site
+/// arms it BEFORE the call and restores the previous value AFTER, on the throwing arm too, so no name outlives
+/// the invocation and a nested invocation is measured by its own name and not its caller's.
+///
+/// **WHY IT IS A `Symbol.for` CHANNEL ON THE PRODUCT AND NOT AN EXPORT THE KERNEL IMPORTS** (`A117` (D6), the
+/// family `TERMINAL_ARM`, `FORGET_PAIR`, `COMMIT_SCOPE` and `RESTART_DRAIN` are declared under): the kernel's
+/// four part modules declare an EMPTY import footprint (`kernel-surface.md §1` item 1; `A110`) and cannot
+/// import this file, so **both sides spell the same key and neither side imports the other**. **IT IS INVISIBLE
+/// TO `Object.keys` AND TO `Object.getOwnPropertyNames`**, so the product's declared own members are unmoved,
+/// no census moves, and no kernel item is minted (`§1` item 2: `K-1`–`K-6` and no seventh name).
+const EXTERNAL_CALL = Symbol.for('provident-storeroom.external-call');
+
+/// **THE NAME ITSELF — the commit the invocation in flight was handed, for the process** (`undefined` where it
+/// was handed none), read by `openCommit` and moved by the channel below and by nothing else.
+let EXTERNAL_COMMIT = undefined;
+
+/// **AND THE MARK'S OWN SECOND FACT IS KEPT, AS `D-46`'s FALLBACK FOR THE CALLERS THAT CANNOT NAME ONE** — the
+/// depth of caller-supplied frames in flight, read at `openCommit`'s unnamed arm and moved by the same channel.
+/// **IT NO LONGER DECIDES ANY CALL THAT NAMES A COMMIT**: `D-45`'s rule is narrowed to the unnamed arm and is the
+/// whole of what answers there, which is what keeps the package's own continuation (`constraintOn`'s nested
+/// `listen`, a pass's scope) JOINING while a listener body's or a constraint body's verb — one frame deeper than
+/// the commit it finds — OPENS. **TWO FACTS, ONE RULE**: the name if the call has one, and authorship only where
+/// it has none (see `openCommit`).
+let EXTERNAL_DEPTH = 0;
+
+/// **THE ONE FORM THE ENTRY'S OWN SITES CALL** — it hands the thunk to the channel the store carries **without a
+/// commit, because the entry's own two sites are a listener body's delivery and a reversal's judgement, and
+/// neither has one to name**, and answers what the invocation answered; its throwable crosses unchanged.
+///
+/// **A STORE THAT CARRIES NO CHANNEL ANSWERS THE INVOCATION WITH NOTHING NAMED** — a store this package never
+/// installed the seam on, or a caller that read the symbol property away. That is the CONSERVATIVE side for this
+/// mechanism: the call then opens its own commit, which is the rule's own absent arm, and it can never join a
+/// commit nobody named.
+export function externalCall(store, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run);
+  return run();
+}
+
+/** The per-store index: `{ open, observers, windows, marks, windowSeq }`, keyed by the store instance and by
+ *  nothing else. **`windows` IS THE STACK OF OPEN WINDOW IDENTITIES** — one number per commit this store opened, the
+ *  top being the window in flight — and it exists so a restart request can name the window that raised it
+ *  (`D-42`'s *"a request belongs to the act that raised it"*, made a measurement instead of an inference).
+ *  **`marks` IS THE STACK BESIDE IT AND IT IS THE SAME ONE STACK READ AS THE JOURNAL MARK** — one entry per commit
+ *  that OPENED, pushed and popped in lockstep with `windows` (`openCommit`/`closeCommit`), so `windowMark` answers
+ *  the outermost opening's mark and a join neither pushes nor pops. */
 const ATTEMPT_INDEX = new WeakMap();
 
 function attemptIndex(store) {
@@ -136,7 +311,7 @@ function attemptIndex(store) {
     // refusal.** The list preserves the Set's own two facts — insertion order and uniqueness — and the copy
     // is taken before any notification, so an observer that removes itself mid-notification still moves
     // nothing.
-    index = { open: 0, observers: [] };
+    index = { open: 0, observers: [], windows: [], marks: [], externalAt: [], windowSeq: 0 };
     ATTEMPT_INDEX.set(store, index);
   }
   return index;
@@ -163,12 +338,126 @@ export function openCommits(store) {
   return attemptIndex(store).open;
 }
 
+/// **⟶ ADDED 2026-10-27 — THE WINDOW IN FLIGHT, AS THE PLAIN ACCESSOR BESIDE THE COUNT ABOVE.**
+///
+/// **IT ANSWERS THE IDENTITY OF THE COMMIT THE STORE HAS OPEN, AND `0` WHERE NONE IS** — a number minted once
+/// per commit that OPENS (`windowSeq`, strictly increasing and never reused) and held on a stack so that a
+/// nested verb's JOIN answers the enclosing window's identity and not a second one. **IT IS READ BY EXACTLY
+/// ONE ACT AND FOR EXACTLY ONE FACT**: `constraints.mjs`'s `reversalWatch` stamps the restart request an
+/// in-commit action raises with the window that raised it, and `drainRestartRequests` consumes a request only
+/// where that stamp equals the window the draining pass runs in. **SO *"A REQUEST BELONGS TO THE ACT THAT
+/// RAISED IT"* — `D-42`'s own sentence — IS MEASURED RATHER THAN ASSUMED**, and the two declared windows that
+/// have no check to run (`D-42`'s `delete` delivery, and the pass a hand drives) no longer need a counting
+/// frame to tell them apart from the write the check belongs to.
+///
+/// **IT IS A PURE READ** in `§4.2` item 1's sense — no state, no code, no journal entry and no file — and it
+/// creates its index on miss exactly as `openCommits` does, so it cannot answer `undefined` on any path.
+export function currentWindow(store) {
+  const windows = attemptIndex(store).windows;
+  return windows.length === 0 ? 0 : windows[windows.length - 1];
+}
+
+/// **⟶ ADDED 2026-10-27 — THE MARK THE WINDOW IN FLIGHT CACHED AT ITS OPENING, AND `undefined` WHERE NO COMMIT
+/// IS OPEN.**
+///
+/// **THE RULING IT CARRIES, THE ARCHITECT, VERBATIM: *"Cache the restoreMark when opening a commit, based on the
+/// last valid state/op of the journal."*** **THE DEFECT IT CLOSES IS `DEF-AE`'s AND IT IS A DATA-INTEGRITY ONE:**
+/// the refused reversal's restore named **the journal's HEAD**, on the reasoning that *"a reversal appends no
+/// journal entry, so that head describes the state that stood BEFORE the action"* — **a reasoning that fails on
+/// exactly one arm**. In the restart arm the ENCLOSING WRITE'S OWN OP STANDS AT THE HEAD when the listener's
+/// reversal runs, so the compensation restored **the write's landing, not the pre-attempt state**: a write that
+/// reported refusal left its own value standing (`9 → 7`).
+///
+/// **SO THE MARK IS TAKEN WHERE IT IS TRUE AND NOT WHERE IT IS NEEDED.** Every commit that OPENS reads the store's
+/// last valid mark (`withAddon().journalMark`, the store's own `journalMark`) and stands it on the window beside
+/// the window's identity. **THE INSTANT IS THE WHOLE POINT**: at an outermost opening nothing of the attempt has
+/// landed yet, so the mark names the state the commit FOUND. A JOIN IS THE SAME ACT AND RE-CACHES NOTHING — a join
+/// appends no window and no mark, so the cache in flight stays the outermost opening's — which is what makes a
+/// repair's write (a join, `D-46`) and a pass's scope (a join on the production path, `D-44`) read the attempt's
+/// own position rather than a later one. **A CALLBACK'S OWN COMMIT IS ITS OWN OPENING WITH ITS OWN CACHE**
+/// (`D-45`/`D-46`: a listener body's call names nothing and opens), so the mark a listener's own attempt restores
+/// to is where ITS window opened.
+///
+/// **A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED, AND `undefined` IS ITS SPELLING.** The store answers
+/// `{k:'s', v:<op id>}` where the journal holds an entry and `{k:'F'}` where it holds none (the FLOOR — the state
+/// the store was born with); `undefined` means the read could not answer at all (a store whose artefact could not
+/// be reached), and the refused-reversal restore REFUSES rather than falling back to the head
+/// (`constraints.mjs`'s `restoreReversal` states that arm). **THE MARK IS OPAQUE HERE**: this file caches the
+/// store's own carrier and never composes a position of its own.
+export function windowMark(store) {
+  const index = attemptIndex(store);
+  if (index.windows.length === 0) return undefined;
+  return index.marks[index.marks.length - 1];
+}
+
+/// **THE MARK THE OPENING TAKES** — the store's own read, once per commit that OPENS and never per join. **IT IS
+/// TAKEN THROUGH THE ENTRY THE ADDON PUBLISHES** (`journalMark`), bound to the store object exactly as every other
+/// addon call is (`commitFile` above is the same form). **A READ THAT THROWS IS A WINDOW WITH NO CACHE AND NOT A
+/// REFUSED CALL**: the opening is not the act the consumer asked for, and refusing the consumer's verb because the
+/// journal read failed would answer a form the verb does not declare — so the arm answers `undefined`, the window
+/// stands without a cache, and the one consumer that needs the mark refuses its own restore instead.
+function journalMarkAtOpening(store) {
+  try {
+    const addon_ = withAddon();
+    return Reflect.apply(addon_.journalMark, store, []);
+  } catch (unanswered) {
+    return undefined;
+  }
+}
+
 /** **THE INCREMENT MOMENT** (`PAR-ADA-15`): the opening of a commit. It is taken iff THIS call opens one —
- *  a call that finds the count already above zero has joined an extant commit and opens nothing. */
-export function openCommit(store) {
+ *  a call that finds the count already above zero has joined an extant commit and opens nothing.
+ *
+ *  **⟶ AND FROM 2026-10-27 THE TEST IS THE COMMIT THE CALL NAMES** (`D-46`; the clause at this section's head):
+ *  **A CALL THAT NAMES A COMMIT JOINS THAT COMMIT, AND A CALL THAT NAMES NONE OPENS A NEW ONE FROM A STORE AT
+ *  REST OR FROM A CALLER-SUPPLIED FUNCTION — while the package's own continuation, which can name nothing
+ *  either, JOINS the commit in flight.** `commit` IS THE ENTRY'S POSITION — `write`'s FOURTH, the one
+ *  `index.d.ts` declares *"the commit, at the FOURTH position of the METHOD"*, whose domain is a RECORD (an
+ *  object carrying an own, present `pending`) and never an id token. **AND WHERE A CALL SITS INSIDE AN
+ *  INVOCATION THE PACKAGE ITSELF MADE OF CALLER CODE, THE NAME IS THE ONE THAT INVOCATION WAS HANDED**
+ *  (`EXTERNAL_COMMIT` above): the kernel names the attempt's commit when it invokes a **repair** — *"so that it
+ *  can be tracked as part of the commit process"* — and names nothing when it invokes a listener body or a
+ *  constraint body. **ONE RULE AND TWO PLACES THE NAME MAY COME FROM; THE ENTRY'S OWN POSITION WINS, THE
+ *  INVOCATION'S IS ITS FALLBACK, AND THE AUTHORSHIP MARK BELOW IS THE FALLBACK OF THE FALLBACK — read only
+ *  where neither position stands.**
+ *
+ *  **SO THE COUNT STILL MOVES BY EXACTLY ONE PER ACT**: an ordinary write's opening is the only one it takes
+ *  (its kernel leg names the record and joins, its pass scope names it and joins, its repair names it and
+ *  joins), a listener body's own write names nothing and is a window of its own beside it (`open` rises by one
+ *  for the callback and falls by one when the callback's call ends, the outer verb's count unchanged across
+ *  it), and a constraint body's nested write does the same (`D-45`). **A JOIN CAN ONLY BE A JOIN OF A COMMIT
+ *  THAT IS OPEN** — where the count stands at zero there is nothing to join, so the call opens, which is what
+ *  keeps `D-44`'s direct `K-2`/`K-3` drive's pass inside a commit of its own. */
+export function openCommit(store, commit) {
   const index = attemptIndex(store);
-  if (index.open > 0) return false;
+  // THE COMMIT THIS CALL NAMES — the entry's own position first, the invocation's second (`EXTERNAL_COMMIT`).
+  const named = commit !== undefined ? commit : EXTERNAL_COMMIT;
+  if (index.open > 0) {
+    // **A NAMED COMMIT IS JOINED** — `D-46`'s rule, and it stands FIRST and decides wherever a name exists.
+    if (named !== undefined) return false;
+    // **AND WHERE NO NAME STANDS, `D-45`'S MARK DECIDES, AND IT IS THE FALLBACK FOR EXACTLY THE CALLERS THAT
+    // CANNOT NAME A COMMIT**: the package's own continuation of the commit in flight runs at the depth that
+    // commit was opened at and JOINS; a call made from a caller-supplied function — one frame deeper — OPENS.
+    const at = index.externalAt.length === 0 ? 0 : index.externalAt[index.externalAt.length - 1];
+    if (EXTERNAL_DEPTH <= at) return false;
+  }
   index.open += 1;
+  // **AND THE WINDOW'S OWN IDENTITY IS MINTED WITH THE OPENING AND STOOD ON THE STACK** (`currentWindow`
+  // above): a commit that JOINS answers an id already held, so the nesting `§4.1` keeps exact in the count is
+  // kept exact in the identity too, and no window id is ever reused.
+  index.windowSeq += 1;
+  appendOwn(index.windows, index.windowSeq);
+  // **⟶ AND THE MARK THE OPENING TAKES, 2026-10-27 — THE ARCHITECT'S RULING: *"Cache the restoreMark when opening
+  // a commit, based on the last valid state/op of the journal."*** **THE CACHE IS TAKEN HERE AND ONLY HERE**: this
+  // is the arm that OPENS (a join returned above and takes nothing), so the store's read names the journal's
+  // position at the instant the commit was entered — before anything the commit will land has landed. **IT IS
+  // TAKEN BEFORE THE OBSERVERS FIRE** (the notification below is part of the opening, and an observer that acts
+  // would open its own commit; this window's mark is the one that stood when the window itself opened). It is
+  // pushed in lockstep with `windows` so the two stacks are one stack, and `closeCommit` releases it with it.
+  appendOwn(index.marks, journalMarkAtOpening(store));
+  // **AND THE DEPTH FALLBACK'S OWN RECORD IS STOOD BESIDE IT**: the depth this commit was opened at, in lockstep
+  // with `windows`, so the next unnamed call can tell the package's own continuation from a callback's act.
+  appendOwn(index.externalAt, EXTERNAL_DEPTH);
   // **THE OBSERVER SEAM IS READ AT THE INSTANT OF THE OPENING** (`§4.2` item 2), one call per opening — and
   // the iteration is a copy, so an observer that unsubscribes itself mid-notification moves nothing. **The
   // copy and the notification are LOCAL INDEX LOOPS** (item `(1c)(i)`): no spread, no iterator.
@@ -185,6 +474,24 @@ export function closeCommit(store, opened) {
   if (!opened) return;
   const index = attemptIndex(store);
   index.open -= 1;
+  // **AND THE WINDOW THE OPENING STOOD ON GOES WITH IT**, by a local index loop rather than through a mutable
+  // prototype's `slice`/`pop` (`contract.md §2.1`'s clause of 2026-10-24 on `F7-1`/`F8-2`). A joining call
+  // opened nothing and releases nothing, so the enclosing window's identity stands. **AND THE DEPTH STOOD BESIDE
+  // IT GOES WITH IT, IN THE SAME LOOP AND AT THE SAME INSTANT**: the two stacks are one stack read two ways, so a
+  // commit's depth can never be left standing for a commit that has closed. **AND THE MARK THE OPENING CACHED
+  // GOES WITH IT IN THAT SAME LOOP** — `windows`, `externalAt` and `marks` are one stack read three ways, so no
+  // closed window's journal position can be answered to a later act.
+  const kept = [];
+  const keptAt = [];
+  const keptMark = [];
+  for (let i = 0; i + 1 < index.windows.length; i += 1) {
+    appendOwn(kept, index.windows[i]);
+    appendOwn(keptAt, index.externalAt[i]);
+    appendOwn(keptMark, index.marks[i]);
+  }
+  index.windows = kept;
+  index.externalAt = keptAt;
+  index.marks = keptMark;
 }
 
 /// **THE TWO CHANNELS, INSTALLED ONCE ON THE OBJECT `storeCreate` RETURNS** (`§4.2` item 4: *"`storeCreate`
@@ -237,6 +544,71 @@ export function installAttemptSeam(instance) {
       configurable: true,
     });
   }
+  // **⟶ AND THE SCOPE, INSTALLED ONCE BY THE SAME RULE** (`§4.2` item 4: *"`storeCreate` installs each channel
+  // once on the object it returns"*; `D-44`). **It is the two moments `openCommit`/`closeCommit` already own,
+  // composed into one bracket and minting no third count**: this channel adds no index, no state and no
+  // increment — it only decides WHO opens. **AND FROM 2026-10-27 IT TAKES THE PASS'S OWN COMMIT AT ITS SECOND
+  // POSITION** (`D-46`): `runAttempt` hands the record `K-2` built, so **the pass's scope NAMES the commit the
+  // attempt is tracked in and joins it** on the production path, **and on a direct `K-2`/`K-3` drive the name
+  // has nothing to join and the scope OPENS the one commit the pass owes** (`D-44`'s direct-pass window).
+  if (typeof instance[COMMIT_SCOPE] !== 'function') {
+    Object.defineProperty(instance, COMMIT_SCOPE, {
+      value: (run, commit) => {
+        const opened = openCommit(instance, commit);
+        try {
+          return run();
+        } finally {
+          closeCommit(instance, opened);
+        }
+      },
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  // **⟶ AND THE INVOCATION'S OWN ENTRY, INSTALLED ONCE BY THE SAME ONE-INSTALLATION RULE, 2026-10-27 —
+  // `D-45`'s channel, carrying `D-46`'s name.** It takes ONE thunk — **the invocation of a caller-supplied
+  // function** — and, at its SECOND position, **the commit that invocation names** (absent where it names
+  // none), runs the thunk with `EXTERNAL_COMMIT` holding that name, and answers what the thunk answered. **THE
+  // NAME IS RESTORED IN A `finally`**, so a body that throws leaves no name standing and the next invocation
+  // reads the one it was handed; and **the arming and the restoring are this closure's whole body**, so nothing
+  // the package does outside an invocation is ever measured by a name. **A CALLER THAT SUPPLIES ONLY THE THUNK
+  // NAMES NOTHING** — which is the rule's own absent arm and not a second rule, and it is how the kernel's
+  // `externalCall` (`kernel-foundations.mjs`) and this module's own `externalCall` above reach the channel.
+  if (typeof instance[EXTERNAL_CALL] !== 'function') {
+    Object.defineProperty(instance, EXTERNAL_CALL, {
+      value: (run, commit) => {
+        const standing = EXTERNAL_COMMIT;
+        EXTERNAL_COMMIT = commit;
+        EXTERNAL_DEPTH += 1;
+        try {
+          return run();
+        } finally {
+          EXTERNAL_DEPTH -= 1;
+          EXTERNAL_COMMIT = standing;
+        }
+      },
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  // **⟶ AND THE RESTART'S CONSUMER, BY THE SAME ONE-INSTALLATION RULE, 2026-10-27.** `runAttempt` calls it
+  // AFTER its pass and INSIDE the scope above, handing THE REPORT THE PASS ANSWERED WITH; the answer is the
+  // report the kernel returns, amended where the restarted check refused (`constraints.mjs`'s
+  // `carryRestartRefusal`) and untouched where none refused. **A STORE WITH NO INJECTED CONSUMER ANSWERS ITS
+  // REPORT UNCHANGED** — the restart machinery is the entry's and its absence is a tree that never loaded it,
+  // which is also a tree that carries no pair and so can have raised no request.
+  if (typeof instance[RESTART_DRAIN] !== 'function') {
+    Object.defineProperty(instance, RESTART_DRAIN, {
+      value: (report) => (typeof RESTART_CONSUMER === 'function'
+        ? RESTART_CONSUMER(instance, report)
+        : report),
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+  }
 }
 
 // ---------------------------------------------------------------------------------------------