provident-storeroom 1.1.0 → 1.2.0

package/README.guide.md

@@ -45,6 +45,12 @@ date and reads `1.0.1` from here on.** **AND THE ONE THING NO PASS WITNESSED IS
 run against the registry, so a registry-installed `1.0.1` is described here from the manifest and from
 measurements on a locally packed, installed artefact, and is still not witnessed as a registry download.**
 
+**⟶ AND THE FIGURE THE PARAGRAPH ABOVE CARRIES IS ITSELF ONE RELEASE BEHIND THE TARBALL IT DESCRIBES, 2026-10-28 — THE VERSION THIS GUIDE DESCRIBES IS `1.1.0`, `1.1.0` HAS BEEN CUT, AND EVERY `1.0.1` THIS GUIDE PRINTS READS `1.1.0` FROM HERE ON.** `RCA-8(g)` ANNOTATE-BESIDE: **the three dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, of `1.0.0` and of `1.0.1`; each was true of the tree it was read on and each is one release behind the shipped tree from this date.** **THE PARAGRAPH THAT OWES THIS IS QUOTED AT ITS OWN BYTES, because a guide that denies its own tarball is the defect this clause closes — `D-48` · `DEF-AC`: *"THE VERSION THIS GUIDE DESCRIBES IS `1.0.1`, AND EVERY `1.0.0` THIS GUIDE PRINTS READS `1.0.1` FROM HERE ON … the tags the tree carries are `v1.0.0` and `v1.0.1`, with `main` sixteen commits past `v1.0.1` and no version bump in any of them (`git describe` at this date reads `v1.0.1-16-gdf3ef88`; `D-41` item `1`'s semver ruling names the next release `1.1.0`, and that release has not been cut)."*** **THE TARBALL DENIES EVERY FIGURE OF THAT SENTENCE, AND IT IS THE FILE THE GUIDE TELLS YOU TO READ: `bindings/js/package.json`'s `version` is `"1.1.0"` at its own bytes, all five `optionalDependencies` pins are `1.1.0` with it, the tags the tree carries are `v1.0.0` · `v1.0.1` and `v1.1.0`, `git describe` reads `v1.1.0-1-gcbc3f8a`, and `D-41` item `1`'s minor has been RELEASED rather than awaited.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** §0's two paragraphs above, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* — itself already corrected to `1.0.0` and then to `1.0.1` — and §11's manifest table all read `1.1.0`; **every `0.5.0`, `1.0.0` and `1.0.1` this guide prints is the figure of its writing date and reads `1.1.0` from here on**, and the six figures — the main `version` and the five pins — move together and never singly (§0 item 1; `PUB-DD-10`). **THE ONE THING THAT IS STILL UNMOVED IS THE ONE THING NO PASS WITNESSED, AND IT IS NOT A FIGURE:** no `npm install` was run against the registry, so a registry-installed `1.1.0` is described here from the manifest and from measurements on a locally packed, installed artefact, and is still not witnessed as a registry download. **NO OTHER CLAIM OF THIS GUIDE MOVES: the `files` allowlist's six rows (§11's dated re-read clause (i)), the packed set's nineteen-bare/twenty-assembled (§11's clause (ii)), the twenty-status set (§11's clause (iv)), the fourteen own members and every API clause stand exactly as they stood.** (`strata/decisions.md` · `D-48` · `DEF-AC`; `D-41` item `1`; `D-42` item `1`; `D-38`; `docs/specs/storeroom-publish/contract.md §2.3` item `3` — the byte-for-byte guide stage this correction travels by.)
+
+**⟶ AND THE RELEASE IN PREPARATION IS NOT THIS GUIDE'S VERSION, 2026-10-28 — THE MANIFEST IS `1.1.0`, AND THIS GUIDE CLAIMS NO `1.2.0`.** `RCA-8(g)` ANNOTATE-BESIDE: **the four dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause; this clause re-reads one figure and adds one pointer, and moves no other claim of this file.** **THE FIGURE, AT ITS OWN BYTES, READ THIS DATE: `bindings/js/package.json`'s `version` is `"1.1.0"` and all five `optionalDependencies` pins are `1.1.0` with it** — the six figures move together and never singly (§0 item 1; `PUB-DD-10`) — **so `1.1.0` is the version this guide DESCRIBES, and it is the version an installed tree answers to.** **A RELEASE IS IN PREPARATION AND IT HAS NOT BEEN CUT: what it adds is listed in `RELEASE-NOTES.md` at the repository root, under a `1.2.0` heading MARKED UNRELEASED, and nothing in that section is a version this guide claims or a behaviour this guide measured as shipped.** **AND THAT FILE SHIPS NOWHERE:** it stands at the repository root and no tarball carries it (§11's `files` allowlist, six rows), so a consumer reading `node_modules/provident-storeroom` has this guide and the six figures of `1.1.0`, and the `1.2.0` list is a CHECKOUT reader's document. **The rule, in one line: this guide describes what was cut (`1.1.0`); `RELEASE-NOTES.md` describes what is being prepared (`1.2.0`, UNRELEASED); neither claims the other's figure.** (`D-41` item `1`; §11's manifest table reads the same six figures; `docs/specs/storeroom-publish/contract.md §2.3` item `3`.)
+
+**⟶ AND THE FIGURES MOVE TO THE PREPARED RELEASE, 2026-10-28 — THE SIX FIGURES THIS GUIDE POINTS AT READ `1.2.0`, AND `1.2.0` IS PREPARED, NOT CUT.** `RCA-8(g)` ANNOTATE-BESIDE: **the five dated paragraphs above stand BYTE-FOR-BYTE and are read THROUGH this clause — so do their readings of `0.5.0`, `1.0.0`, `1.0.1` and `1.1.0`; each was true of the tree it was read on.** **THE MANIFEST AT ITS OWN BYTES THIS DATE: `bindings/js/package.json`'s `version` is `"1.2.0"` and all five `optionalDependencies` pins are `1.2.0` with it** — the six figures move together and never singly (§0 item 1; `PUB-DD-10`) — **and the five platform manifests' own `version` fields read `1.2.0` with them, which is eleven sites and one rebuild.** **SO THE SITES ARE RE-READ, NOT RE-SPELLED:** this section's version line, §2.2's five exact pins, §8.1's *"an installed `0.5.0`"* and §11's manifest table all read `1.2.0`; **every `0.5.0`, `1.0.0`, `1.0.1` and `1.1.0` this guide prints is the figure of its writing date and reads `1.2.0` from here on.** **AND WHAT THIS CLAUSE DOES NOT CLAIM, SAID FIRST BECAUSE IT IS THE EASIER THING TO GET WRONG: `1.2.0` IS PREPARED AT THOSE SIX FIGURES AND THE TAG IS NOT CUT — `git tag --list` carries `v1.0.0` · `v1.0.1` · `v1.1.0` and no `v1.2.0`, so nothing here says the release is cut, and the tag is not cut until the architect cuts it.** **THE ONE THING THAT IS STILL UNMOVED IS THE ONE THING NO PASS WITNESSED, AND IT IS NOT A FIGURE:** no `npm install` was run against the registry, so a registry-installed `1.2.0` is described here from the manifest and from measurements on a locally packed, installed artefact, and is still not witnessed as a registry download. **NO OTHER CLAIM OF THIS GUIDE MOVES: the `files` allowlist's six rows (§11's dated re-read clause (i)), the packed set's nineteen-bare/twenty-assembled (§11's clause (ii)), the twenty-status set (§11's clause (iv)), the fourteen own members and every API clause stand exactly as they stood.** (`D-41` item `1`; `D-48` · `DEF-AC`; `docs/specs/storeroom-publish/contract.md §2.3` item `3` — the byte-for-byte guide stage this correction travels by; `scripts/publish.sh`'s eleven cells, and the tag coupling `release.md §2.5` puts AFTER them.)
+
 **AND ONE THING A READER OF THE INSTALLED PACKAGE SHOULD KNOW BEFORE THE CITATIONS: WHEN THIS DOCUMENT IS AT
 `node_modules/provident-storeroom/README.guide.md`, IT IS THIS GUIDE.** **Its ONE authored home is
 `docs/guides/package-use.md` in the repository, and the release's assembly stages it byte-for-byte at the packaging
@@ -688,6 +694,50 @@ filter nothing on one.** **There is no read-side enforcement arm, none is declar
 writes and on nothing else** — and **reads consult no constraint's verdict, filter nothing on one, and refuse
 nothing because of one.**
 
+### §7.6 ★ `context.value` is what the write verb returned — read anything else yourself
+
+**★ THE ONE SENTENCE TO CARRY AWAY: `context.value` is the value the write verb returned; a constraint that
+cares about another location reads it.** (`D-50`, the architect, verbatim: *"If a constraint needs to look for
+the data at a given location, it can read()"*.)
+
+**AND THE CASE THAT MAKES IT MATTER IS A REPAIR THAT LANDS SOMEWHERE ELSE.** A constraint that refuses `2` at
+its own address `['a']` returns a repair that writes `11` at a *different* address `['b']`. **The repair's op is
+the attempt's last op, so the re-run hands your body the value that op landed — `11` — while the address your
+pair judges still stands at `2`.** **That is not a machinery defect: it is the value the write verb returned, and
+the package cannot be wrong about a value it was told to hand over — it can only be wrong about what it stored.**
+**If your constraint cares about the state at any other location — the address it judges, the address its repair
+landed at, or anywhere else — IT READS THAT LOCATION.** The body is your code, it closes over the store handle
+you already hold, and `store.read(address)` is a published verb. **Measured 2026-10-28**
+(`tests/e2e/discard-witness.mjs`, the `W8` cell): the re-run handed the pair `11` while its own address read
+`2`; **the same body with `store.read(['b'])` refused on what it read** — the write failed and the store was
+restored — **and the same body without the read passed, answering its record with its own value still standing at
+its address.** **The read is the whole difference.**
+
+**★ AND THE CONSEQUENCE A READER GETS WRONG, IN `D-50`'S OWN WORDS: *"a constraint that reads inside its body is
+caller code entering the surface, so by `D-45` that read opens its own commit"* — **⟶ MEASURED 2026-10-28, AND THAT CLAUSE IS WRONG: A READ BRACKETS NO COMMIT AT ALL.** `read`, `readLiteral` and `constraints` are the surface's **NON-BRACKETING** calls — the count during a constraint body's read is the attempt's own and is left undisturbed, `attempt-opened` does not fire for it, and the same `attempt` is in force. **So the accurate consequence is the shorter one: a read inside a body runs INSIDE the attempt's window, opens nothing, and disturbs nothing.** (The `D-45` quote above is kept as the reading of its own date; this sentence governs.) — AND A READ RUNS NO CHECK, SO
+NOTHING IS JUDGED BY IT.** **No constraint is asked on the value it returns, no pass runs, and the value you
+read back is never a verdict.** **AND THE COUNT'S OWN RULE IS WHERE THE ACT'S SHAPE IS VISIBLE — MEASURED
+2026-10-28 AT THE `W8` CELL, ON BOTH SIDES OF THE READ: `read`, `readLiteral` and `constraints` are the surface's
+NON-BRACKETING calls — no commit is bracketed for them — so the count during your read is the attempt's own
+(`open` `1`, `live` `1`) and it is left undisturbed (`open` `1`, the same attempt).** **THE DECLARED SENTENCE IS
+THE AUTHORSHIP — the read is not the write's act — and the count shows what that authorship costs: nothing is
+opened and nothing is judged for it.** **So the load-bearing half for you is the authorship and the absence of a
+check: your read is your own act at the surface, it carries no judgement, and it neither re-asks a constraint nor
+re-runs the pass. A read is data, never a verdict — if you want a state judged, read it and judge it in your
+body.**
+
+**⟶ AND THE PASS ASKS EXACTLY THE PAIRS STANDING AT THE ADDRESS IT WRITES, 2026-10-28 — `D-50`'S CONSEQUENCE, WHICH NO CLAUSE ABOVE SPELLS OUT.** `RCA-8(g)` ANNOTATE-BESIDE: **every clause of §7.6 above stands BYTE-FOR-BYTE and is read THROUGH this one; this clause adds one declaration and moves nothing it prints.** **THE RULE: A WRITE'S CONSTRAINT PASS JUDGES THE PAIRS STANDING AT THE ADDRESS IT WRITES — the kernel's own `pairsAtAddress` reads the pair record at that one address — SO A PAIR AT A DIFFERENT ADDRESS IS NOT ASKED.** **If a constraint cares about another location it READS it** (`D-50`, the architect, verbatim: *"If a constraint needs to look for the data at a given location, it can read()"*). **MEASURED 2026-10-28, on this checkout, through the published entry, in a two-address drive:** a pair `b1` registered at `['b']`; **a write at `['a']` asked `b1` `0` times**; **the same write at `['b']` asked it once**, and the value the body was handed was the one that write returned. **So an action one address away is INVISIBLE to your pair** — it was never asked at the address the action moved — **and the body's own `store.read` is the only thing that makes it visible.** **That is the whole reason this section tells you to read what you care about: the pass will not ask a pair that does not stand where you wrote.** (`held-listener/contract.md §2.8` item `1`, `HL-8`: *"the pass selects the rows whose address IS the triggering address"*, preserving the EXACT-ADDRESS rule rather than widening it; `D-50`; §7.1–§7.5's declarations; the pass's own scan at `bindings/js/src/entry/kernel-foundations.mjs:782`.)
+
+### §7.7 ★ The check is BOUNDED — THREE restarts per terminal act, and past the budget it fails closed
+
+**★ THE LIMIT, DECLARED HERE BECAUSE NO CLAUSE OF THIS GUIDE SAID IT: A CONSTRAINT CHECK RESTARTS AT MOST THREE TIMES PER TERMINAL ACT.** The bound is **`RESTART_LIMIT` = `3`**, one exported constant at **`bindings/js/src/entry/constraints.mjs:1366`**. **THE BUDGET IS SPENT AND NOT RESET by an action raised inside a restart** — a body that reverses again inside a restart's own ask spends the SAME budget and not a fresh one — **AND PAST IT THE CHECK FAILS CLOSED IN THE ONE FORM:** the write throws the same plain `{status, message, log}` it throws for a refused pass (§8), with `status` **`'ConstraintPassRefused'`** and **ONE log entry** whose message says the budget was spent rather than that a pair refused a state it never judged. **The store is restored** — the request's own watch records what is owed — so the terminal act leaves no unjudged effect standing (`D-42` item `3`; `D-41` item `4`).
+
+**MEASURED 2026-10-28, ON THIS CHECKOUT, THROUGH THE PUBLISHED ENTRY — AND THE MEASUREMENT IS THE POINT: THE RESIDUAL IS THE BUDGET, NOT THE STATE AND NOT THE JOURNAL.** A pair whose body raises ONE FRESH REVERSAL on every ask the restart makes, **with every ask passing**, was driven twice: **with `60` fresh reversals available it rests at exactly `3` restart asks** (the listener's own action plus one per ask — `4` actions in all), **and with `40` available it answers identically, `3`.** **The body had `57` and `37` reversals it never got to spend, and nothing structural stopped it: every ask it made passed.** The terminal write then refused `ConstraintPassRefused` with its log entry saying the budget was spent.
+
+**AND WHY THE BOUND EXISTS, SAID PLAINLY: NO STRUCTURAL STATE DISTINGUISHES A BODY THAT KEEPS REVERSING FROM ONE THAT MEANS TO.** The machinery cannot tell a loop from a caller with more work to do, so the restarts are COUNTED and the check fails closed instead of spinning.
+
+**WHAT DOES NOT SPEND THE BUDGET**, so a lawful in-commit action costs at most one round and no more: **a request whose watch shows no moved address is consumed and asks nothing** — it can neither loop nor exhaust the budget — and **the count belongs to the PASS's own scope**, so a nested pass (a listener body's own write) has a scope and a budget of its own, exactly as it has its own commit (`js/contract.md §2.6`'s clause of 2026-10-27, item `4`).
+
 ---
 
 ## §8 · Refusals
@@ -1288,6 +1338,34 @@ tree sharing no mutable member with the store or with another crossing**, which
 
 **Neither window is new and neither is a defect**: both are places **a pass does not begin**, not places a judgement was skipped mid-flight. **And every pass that DOES run drains its own restart request** — so the fail-state is bounded by the two acts that run none.
 
+**⟶ ADDED 2026-10-28 — `D-49`: THE DISCARD IS NOW OBSERVABLE ON THE `delete`'S OWN ANSWER, AND THE OTHER
+WINDOW STILL CARRIES NOTHING. READ THIS BEFORE YOU RELY ON EITHER FAIL-STATE.**
+
+**THE USE CASE THAT MADE IT A DEFECT, IN YOUR TERMS.** Your `window.tabs` is one object; **a listener you
+installed at `window.tabs` DOES fire when you delete `window.tabs.landingPage`** — the triggered set's rule is the
+address prefix, and the invocation's one argument is the deleted address. That is exactly where you would check
+your own invariant — *"exactly one tab is active"* — **and that check IS the kind of act the delete-delivery
+window throws away**: if it fails and you raise a `rollback`, **the request dies with the window** (`DEF-AH`).
+
+- **WHAT YOU CAN NOW SEE.** **A `delete`'s record carries `discarded` beside its four members** — a list, `0` or
+  `1` long, of `{ opId, addresses }`: **`opId` is the id the reversal you raised named**, and **`addresses` are
+  the addresses the discarded check would have been asked at**. **`record.discarded.length === 0` means this
+  act's delivery discarded nothing.** **This is a WITNESS, not a repair** — the delete still answers everything
+  it answered, **throws nothing**, mints no new status, and the reversal's effect **still stands**; the
+  fail-state, the exits below and the behaviour of both windows are unchanged.
+- **READ IT BY ITS NAME, AND EXPECT IT NOT TO BE ENUMERABLE.** `record.discarded` works; **`Object.keys(record)`
+  still prints the four members you already know**, and **a spread or `Object.assign` copy of a receipt does not
+  carry the witness** — read `discarded` off the record itself.
+- **WHAT IT CANNOT SHOW, SAID PLAINLY.** **A registration's answer (`addConstraint`) is an opaque identity and
+  carries NO witness** — an action raised inside that evaluation is still unobservable, and no member was
+  invented for it. **And the machinery holds ONE pending request per instance**: a second in-flight action
+  overwrites the first, so the witness reports the **last** request a delivery raised, and earlier ones were
+  never recorded. **Neither limit is a defect; both are the declared shape.**
+
+**THE EXITS ARE STILL YOURS AND ARE UNCHANGED: reload the file, or regenerate the store.** What changed is that
+**the `delete` now tells you the discard happened** — *"a fail-state is honest only if the consumer learns it
+happened"* (`D-49`).
+
 ### §12.7 A skip is not a green, and your own throws are not refusals
 
 **WHAT BREAKS:** **a `skipped` cell is a cell that DID NOT RUN** — *"a skip is not a green"*, in the authority
@@ -1335,3 +1413,5 @@ quietly.**
   document, not a test report:** the declared documents are the instrument for questions of semantics, and a
   driven run is the instrument for questions of behaviour. **This guide tries to say which is which, and it is not
   the instrument that decides between them.**
+
+**⟶ CORRECTED 2026-10-28 — THE BULLET ABOVE'S *"the two of 2026-10-26"* NO LONGER COUNTS THIS FILE, AND THE FIGURE IS MOVED RATHER THAN THE RULE.** `RCA-8(g)` ANNOTATE-BESIDE: **the bullet above stands BYTE-FOR-BYTE and is read THROUGH this clause.** **This file now names FOUR measurements of its own — the two of 2026-10-26 the bullet carries, §7.6's two-address `b1` drive and §7.7's 60/40-reversal restart-budget drive, both taken 2026-10-28 on this checkout through the published entry — and each is named where it stands rather than gathered here.** **WHAT DOES NOT MOVE IS THE BULLET'S RULE AND THE DOCUMENT'S OWN STANDING: this guide is a consumer document and not a test report; a figure it states is either declared and cited or measured and marked; and the declared documents and the driven batteries remain the instruments for questions of semantics and of behaviour respectively.** **A reader who wants the measurements re-run finds their drives named at their sites, and no figure of this file is offered as a green.**

package/index.d.ts

@@ -485,6 +485,41 @@ export interface DeleteRecord {
    * journal entry, so there is no op to carry: **nothing is named because nothing was destroyed.**
    */
   readonly op: JournalOp | null;
+  /**
+   * **THE DISCARD'S WITNESS — THE REVERSALS THIS ACT'S OWN DELIVERY RAISED AND THE PACKAGE THREW AWAY**
+   * (`strata/decisions.md` · `D-49`, the architect, verbatim: *"Make discard observable"*; `DEF-AH`).
+   *
+   * **WHY THIS MEMBER EXISTS.** A `delete`'s listener delivery **runs no constraint pass** — there is no attempt
+   * for one to run over — so a `rollback` a listener body issues inside it raises a **restart request with no
+   * consumer**, and the fail-state is honest only if the caller learns it happened (`D-43` item 2's fail-state
+   * and both exits stand; `D-49` owes the witness and nothing else). **A listener at `window.tabs` fires for a
+   * delete at `window.tabs.landingPage`** — the triggered set's membership rule is the address prefix — **and the
+   * check it runs there is exactly the act the window discards**; this member is where that caller reads it.
+   *
+   * **ITS SHAPE, AND IT IS A LIST SO THE MEMBER CAN CARRY ONE TODAY AND MORE WITHOUT A SECOND SPELLING.** The
+   * restart machinery holds **one** pending request per instance (a second in-flight action overwrites the
+   * first — a declared limit, not a claim of this member), so the array is **`0` or `1` long**:
+   *   * `opId` — **the store's own echo of the id the discarded reversal named**, or `null` where the reversal's
+   *     call answered no id;
+   *   * `addresses` — **the addresses the discarded check would have been asked at** (the watch's own addresses,
+   *     each a fresh segment list), so a caller can re-run its own check at exactly those addresses.
+   *
+   * **A WITNESS IS NOT A REFUSAL.** The `delete` still answers what it answered — this record's other members
+   * are unmoved, the act **throws nothing**, **no member of the closed status set is minted**, and the reversed
+   * effect **still stands** (the request is reported, not re-run). **AND THIS MEMBER IS A NON-ENUMERABLE OWN
+   * PROPERTY**: `Object.keys(record)` and every deep-equality over the record read the same four members they
+   * read before, while a caller reads the witness **by its name**. A spread or `Object.assign` copy of the record
+   * does not carry it — read the member off the record itself.
+   *
+   * **WHAT IT CANNOT CARRY, SAID HERE RATHER THAN LEFT TO BE DISCOVERED.** The other passless window — a
+   * registration's own evaluation (`addConstraint`) — answers an **opaque identity** and carries **no witness**:
+   * an identity is not a record and no member of it is declared, so the action raised there remains unobservable
+   * without a new surface (`D-49`'s own instruction: say so rather than invent a member).
+   */
+  readonly discarded: readonly {
+    readonly opId: string | null;
+    readonly addresses: readonly Address[];
+  }[];
 }
 
 /**

package/index.mjs

@@ -87,9 +87,10 @@ import { withAddon, boundaryReject, adoptModuleContext } from './src/entry/artef
 import { VALUE_ARGUMENT_POSITION, accessorOrSymbolArm, arrayClass, classSpelling, extendedPath, hasLoneSurrogate, inDomainAddress, isAdmittedArray, isLawfulListenerElement, isPlainObjectValue, protoClass, shapeArmClass, targetSpelling, valueReject, valueTargetSpelling } from './src/entry/class-decision.mjs';
 import { encodeAddress, encodeFilePath, encodeJournalLength, encodeOpId, encodeTier, encodeValue, handleWire, inDomainHandle } from './src/entry/carrier.mjs';
 import { admittedConstraintBatch, constraintAddress, decodeBaseState, decodeJournalOp, decodeSegments, decodeValue, encodeConfig, spellConstraintAddress } from './src/entry/frame.mjs';
-import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, entryOf, homeAddressKey, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
+import { addressSpelling } from './src/entry/kernel-foundations.mjs';
+import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, homeAddressKey, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
 import { commitPositionRefusal, constraintOverwrittenByListen, deliver, listenerStandingAt, registerOn, terminalArm } from './src/entry/delivery.mjs';
-import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintWrite, constraintsKernel, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, withdrawStanding } from './src/entry/constraints.mjs';
+import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintWrite, constraintsKernel, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, withdrawStanding } from './src/entry/constraints.mjs';
 const require_ = createRequire(import.meta.url);
 const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release', 'storeroom_js_binding.node');
 
@@ -470,9 +471,38 @@ export function storeCreate(cfg) {
     /// `DeleteRecord.op`): the member `write`'s record carries, at the same name, so `rollback(record.op.opId)`
     /// reverses the delete. `null` is the `D-3` arm that removed nothing — it appended no entry, so it names
     /// no op — and it crosses unchanged rather than folding to `undefined` (`crossing.md §1.3`).
+    ///
+    /// **⟶ AND IT CARRIES THE DISCARD'S WITNESS FROM 2026-10-28 — `D-49`, `strata/decisions.md`, THE ARCHITECT,
+    /// VERBATIM: *"Make discard observable"*** (`index.d.ts` `DeleteRecord.discarded`; the use case's own
+    /// foundation is the prefix rule the delivery already obeys: **a listener at `window.tabs` FIRES for a
+    /// delete at `window.tabs.landingPage`, and the check it runs there is exactly the kind of act the
+    /// `delete`-delivery window throws away**).
+    ///
+    /// **`delete` IS THE ONE ACT WHOSE DELIVERY RUNS NO PASS AND WHOSE ANSWER SURVIVES TO TELL** (`D-43` item
+    /// 2's other window is a registration, whose answer is an opaque identity and carries nothing). So the
+    /// request a listener body raises inside THIS window — a `rollback`, stamped with this commit's identity by
+    /// `reversalWatch` — is read at the end of the delivery and reported **BESIDE** the record's four members, by
+    /// the one rule `D-49` sets: **the act still answers what it answered, no status is minted, and the witness
+    /// is not a refusal.**
+    ///
+    /// **THE MEMBER IS A NON-ENUMERABLE OWN `data` PROPERTY, AND THE CHOICE IS DECLARED.** It is **visible to the
+    /// caller by its name** (`record.discarded`) and declared in `index.d.ts`, while the record's **enumerable
+    /// member set stays the four its declaration and its cells assert** — `Object.keys`, every deep-equality over
+    /// a receipt and every census of a record's members read exactly what they read before. **A witness added by
+    /// moving the record's own declared ENUMERABLE shape would make the cells that assert that set's readings
+    /// false to buy nothing a caller needs**; a `Symbol.for` key would be the family's other device (`A117` (D6))
+    /// but is not declarable as a member of `DeleteRecord`, and `D-49` asks for the member to be declared.
+    ///
+    /// **THE VALUE IS `[]` WHERE NOTHING WAS DISCARDED AND ONE `{ opId, addresses }` ENTRY WHERE A REQUEST WAS**
+    /// — the id the reversal named (the store's own echo) and the addresses the discarded check would have been
+    /// asked at. **NO PASS RUNS, NO BODY IS INVOKED, NO JUDGEMENT IS TAKEN AND THE BEHAVIOUR OF THE WINDOW IS
+    /// UNMOVED**: the request is consumed (reported) and its effect still stands.
     delete(address, tier) {
       // **⟶ `§4.1`: `delete` OPENS ONE.**
       const opened = openCommit(instance);
+      // **THE WINDOW THIS ACT OWNS, TAKEN AT ITS OPENING** — the identity `reversalWatch` stamps a request with,
+      // so that what the witness reads is the request THIS delivery raised and never another window's.
+      const window = currentWindow(instance);
       try {
         const args = arguments.length >= 1 ? [encodeAddress(address, undefined, 'first argument')] : [];
         // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
@@ -488,6 +518,18 @@ export function storeCreate(cfg) {
         };
         // `A43`: a delete FIRES its own triggered set, on the same window as a write (`docs/specs/storeroom-js/surface.md §2.7` item 2).
         deliver(state, receipt.triggered, answer.triggeringAddress);
+        // **⟶ `D-49`: THE WITNESS, READ AFTER THE DELIVERY AND REPORTED BESIDE THE RECORD** — the delivery is
+        // the only body-invoking instant this act has, so a request standing after it is one this window raised.
+        // **ONLY A DELETE THAT OPENED ITS OWN WINDOW REPORTS**: a call that joined an enclosing commit has no
+        // window of its own to witness, and any request under that identity belongs to the act that opened it
+        // (`witnessDiscardedReversal` clears a request of the window handed in and of no other).
+        const discarded = opened === true ? witnessDiscardedReversal(instance, window) : null;
+        Object.defineProperty(receipt, 'discarded', {
+          value: discarded === null ? [] : [discarded],
+          enumerable: false,
+          writable: false,
+          configurable: true,
+        });
         return receipt;
       } finally {
         closeCommit(instance, opened);
@@ -631,8 +673,8 @@ export function storeCreate(cfg) {
       if (overwritten !== null) {
         boundaryReject(
           'AddressMalformed',
-          spellConstraintAddress(overwritten.address),
-          `the listener '${handle}' cannot be installed at ${JSON.stringify(overwritten.address)}: the constraint `
+          addressSpelling(overwritten.address),
+          `the listener '${handle}' cannot be installed at ${addressSpelling(overwritten.address)}: the constraint `
             + `'${overwritten.id}' stands there, and a listener and a constraint do not share one`,
         );
       }
@@ -821,9 +863,9 @@ export function storeCreate(cfg) {
       if (collided !== null) {
         boundaryReject(
           'AddressMalformed',
-          spellConstraintAddress(collided.address),
+          addressSpelling(collided.address),
           `the listener '${site.id}' cannot share its handle with the constraint '${site.id}' at `
-            + `${JSON.stringify(collided.address)}: a listener and a constraint do not share one`,
+            + `${addressSpelling(collided.address)}: a listener and a constraint do not share one`,
         );
       }
       const held = site.state.constraints.get(constraintPairKey(site.addresses, site.id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -40,11 +40,11 @@
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.1.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.1.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.1.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.1.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.1.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.2.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.2.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.2.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.2.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.2.0"
   },
   "publishConfig": {
     "access": "public"

package/src/entry/constraints.mjs

@@ -4,7 +4,7 @@ import { appendOwn, fail, refusalLog } from './refusal.mjs';
 import { withAddon, require_ } from './artefact.mjs';
 import { classSpelling, isAdmittedArray, isPlainObjectValue } from './class-decision.mjs';
 import { constraintAddress } from './frame.mjs';
-import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver, openCommits } from './state.mjs';
+import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver, openCommits, closeCommit, openCommit, windowMark } from './state.mjs';
 // **THE KERNEL'S OWN RECORD, FOR ONE FIELD AND ONE ONLY** (`D-46`/`D-30`): `kernelFor(store)` answers the
 // instance's kernel record — the same accessor every kernel act takes the instance through — and
 // `reversalAtRest` below reads that record's own `live` map for the count of OPEN ATTEMPTS. `kernel-foundations`
@@ -1464,6 +1464,79 @@ export function drainRestartRequests(instance, report) {
   }
 }
 
+/// **⟶ ADDED 2026-10-28 — `D-49`: THE DISCARD'S WITNESS, AND IT IS READ BY THE ACT WHOSE WINDOW DISCARDED THE
+/// REQUEST.**
+///
+/// **THE RULING, THE ARCHITECT, VERBATIM: *"Make discard observable"*** (`strata/decisions.md` · `D-49`), and
+/// **`DEF-AH` is the defect it answers**: a restart request raised inside one of the two windows that run **no
+/// pass** — a `delete`'s listener delivery, and a registration's own evaluation — **died with its window and the
+/// caller could not learn that it did.** **The fail-state stands** (`D-43` item 2, both exits) — **what was
+/// missing was the WITNESS.**
+///
+/// **WHAT THIS FUNCTION IS, AND WHAT IT IS NOT.**
+///   * **IT RUNS NO PASS, NO BODY AND NO JUDGEMENT.** It reads the instance's own restart record — the record
+///     `reversalWatch` raised the request in — and answers a fresh copy of the two facts a consumer needs: the
+///     id the reversal named (`reversalId`, the store's own echo) and the addresses the discarded check would
+///     have been asked at (`the watch's addresses`, deduplicated by spelling and copied segment for segment).
+///     **THE STORE IS NOT TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS
+///     MOVED** — the `D-49` bar: *"a witness is not a refusal: the act still answers what it answered, the
+///     discard is reported beside it, and nothing new is minted in the closed status set."*
+///   * **IT CONSUMES THE REQUEST IT REPORTS.** A request whose window is the caller's has no consumer that could
+///     ever run it (the window's act ran no pass, and a later pass compares the identity and drops it — the
+///     drain's own arm), so clearing the slot here moves no behaviour: it is the same clearing the drain would
+///     perform on a mismatched window and the at-rest watch performs on a new reversal. **IT ONLY EVER CLEARS A
+///     REQUEST OF THE WINDOW HANDED IN** — a request raised in another window is left exactly where it stands,
+///     so an enclosing act's own consumer is never robbed of it.
+///   * **IT IS NOT THE DRAIN.** `drainRestartRequests` is the consumer of a pass's own window and RUNS the
+///     restarted check; this function is the consumer of a window that has none and only REPORTS it. **Two
+///     consumers, two windows, and neither takes the other's request** (`D-44`: *"every request has a
+///     consumer"* — for the two passless windows the consumer is the caller's own record).
+///
+/// **THE BOUND, STATED SO THE WITNESS IS NOT READ AS MORE THAN IT IS.** The restart record holds **ONE** pending
+/// request (a second in-flight action overwrites the first — the record's own declared shape, UNMOVED by this
+/// pass), so the witness reports the LAST request the window raised and no list of earlier ones exists to report.
+/// **The registration window is the other named window and it has no such reader**: its answer is an identity, and
+/// the identity is opaque by declaration, so nothing this function could answer would reach it without a new
+/// surface — `D-49`'s own instruction is to say so rather than to invent one.
+export function witnessDiscardedReversal(instance, window) {
+  const record = RESTARTS.get(instance);
+  // NO ACTION WAS EVER TAKEN ON THIS INSTANCE, OR THE LAST ONE WAS ALREADY CONSUMED: nothing stands to report.
+  if (record === undefined || record.pending === null) return null;
+  const request = record.pending;
+  // **A REQUEST BELONGS TO THE ACT THAT RAISED IT** (`D-42` item 3, measured by the `window` stamp of
+  // 2026-10-27): a request standing from another window is that window's and is left where it stands.
+  if (request.window !== window) return null;
+  record.pending = null;
+  const addresses = [];
+  const spellings = [];
+  for (let index = 0; index < request.watched.length; index += 1) {
+    const address = request.watched[index].address;
+    const spelling = homeAddressKey(address);
+    let seen = false;
+    for (let known = 0; known < spellings.length; known += 1) {
+      if (spellings[known] === spelling) {
+        seen = true;
+        break;
+      }
+    }
+    // ONE ADDRESS ONCE: two pairs over one address (or one pair naming it twice) are one address the check owed,
+    // and the witness reports the subject and not the walk.
+    if (seen) continue;
+    appendOwn(spellings, spelling);
+    // **A FRESH SEGMENT LIST PER ADDRESS** (`crossing.md §1.1`'s copy-out discipline): the pair's own array is
+    // the registry's and is never handed to a caller.
+    const copy = [];
+    for (let segment = 0; segment < address.length; segment += 1) appendOwn(copy, address[segment]);
+    appendOwn(addresses, copy);
+  }
+  // THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED — `null` where the reversal's call answered no id (the
+  // request stands and the act's answer did not reach the echo, which is a real arm a caller can see).
+  return {
+    opId: typeof request.reversalId === 'string' ? request.reversalId : null,
+    addresses,
+  };
+}
+
 /// **⟶ THE REFUSAL'S ONE CARRIER TO WHICHEVER DRIVER ASKED — ADDED 2026-10-27.**
 ///
 /// **THE REPORT IS AMENDED IN TWO PLAIN MEMBERS AND CARRIES THE REFUSAL WHOLE UNDER A THIRD, SYMBOL-KEYED
@@ -1691,46 +1764,63 @@ export function judgeReversal(instance, watched, reversalId) {
     }
     return undefined;
   }
-  // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
-  // wider, and the same list is what a refusal has to put back — with the tier capture the watch took, so a
-  // restore knows WHERE each value stood and not merely what it was.
-  const moved = [];
-  for (let index = 0; index < watched.length; index += 1) {
-    const one = watched[index];
-    // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
-    // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
-    // reversal found.
-    const after = standingAt(instance, one.address);
-    if (sameStanding(one.before, after) === true) continue;
-    appendOwn(moved, {
-      entry: one.entry,
-      address: one.address,
-      before: one.before,
-      beforeTier: one.beforeTier,
-      beforeTiers: one.beforeTiers,
-      after,
-    });
-  }
-  for (let index = 0; index < moved.length; index += 1) {
-    const one = moved[index];
-    // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
-    // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
-    // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).
-    let outcome;
-    try {
-      outcome = reversalOutcome(instance, one.entry, one.address, one.after);
-    } catch (thrown) {
+  // **⟶ AND THE AT-REST JUDGEMENT RUNS INSIDE A COMMIT, 2026-10-27 — `D-44`'s INVARIANT AND `DEF-AE`'S CACHE.**
+  // `D-44`: *"There should be no state where a constraint is being checked without an open commit. Any action that
+  // would cause a constraint check should open a commit before beginning."* **THE AT-REST JUDGEMENT WAS THE ONE
+  // CHECK THAT RAN OUTSIDE ONE** — `reversalWatch` had already decided `reversalAtRest` on the count this call
+  // found (`open` `0`, `live` `0`), so the discriminator's reading is unmoved by the opening that follows it —
+  // **and the window it opens is what carries the mark the restore owes back** (`state.mjs`'s `openCommit` caches
+  // the journal's last valid position at the opening; `windowMark` answers it). **A REVERSAL APPENDS NO ENTRY**, so
+  // the mark taken here is still the PRE-REVERSAL state — which is why the at-rest control restores exactly what
+  // it restored before. **ON THE RESTART ARM THIS CALL JOINS** the pass's window (the drain runs inside the pass's
+  // own scope, `kernel-attempt.mjs`) and re-caches nothing, so the mark in flight stays the OUTERMOST opening's:
+  // the position the attempt found. **THE `finally` RELEASES THE WINDOW ON EVERY ARM, INCLUDING THE THROWING ONE**,
+  // because a refusal that leaves a commit standing is the count this package's own cells measure.
+  const opened = openCommit(instance);
+  try {
+    // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
+    // wider, and the same list is what a refusal has to put back — with the tier capture the watch took, so a
+    // restore knows WHERE each value stood and not merely what it was.
+    const moved = [];
+    for (let index = 0; index < watched.length; index += 1) {
+      const one = watched[index];
+      // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
+      // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
+      // reversal found.
+      const after = standingAt(instance, one.address);
+      if (sameStanding(one.before, after) === true) continue;
+      appendOwn(moved, {
+        entry: one.entry,
+        address: one.address,
+        before: one.before,
+        beforeTier: one.beforeTier,
+        beforeTiers: one.beforeTiers,
+        after,
+      });
+    }
+    for (let index = 0; index < moved.length; index += 1) {
+      const one = moved[index];
+      // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
+      // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
+      // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).
+      let outcome;
+      try {
+        outcome = reversalOutcome(instance, one.entry, one.address, one.after);
+      } catch (thrown) {
+        const undo = restoreReversal(instance, moved);
+        throw reversalRefusal(one, one.after, null, reversalId, undo, thrown);
+      }
+      if (outcome === true) continue;
+      // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
+      // (ii)–(iii), at the reversal's own instant) — and BEFORE the refusal is built, EVERY address the reversal
+      // moved is put back, so the store the consumer meets holds no state this refusal refused.
       const undo = restoreReversal(instance, moved);
-      throw reversalRefusal(one, one.after, null, reversalId, undo, thrown);
+      throw reversalRefusal(one, one.after, reversalSaid(outcome), reversalId, undo, null);
     }
-    if (outcome === true) continue;
-    // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
-    // (ii)–(iii), at the reversal's own instant) — and BEFORE the refusal is built, EVERY address the reversal
-    // moved is put back, so the store the consumer meets holds no state this refusal refused.
-    const undo = restoreReversal(instance, moved);
-    throw reversalRefusal(one, one.after, reversalSaid(outcome), reversalId, undo, null);
+    return undefined;
+  } finally {
+    closeCommit(instance, opened);
   }
-  return undefined;
 }
 
 /// **THE REFUSAL'S OWN UNDOING — THE STORE RETURNS ITS OWN STATE TO ITS JOURNAL MARK, AND THE WATCH SAYS WHAT
@@ -1757,6 +1847,34 @@ export function judgeReversal(instance, watched, reversalId) {
 /// boundary's own codec folds to the carrier's ABSENT arm (`crossing.md §1.3`): the store's own spelling for
 /// *"the head"*.
 ///
+/// **⟶ AND THE TWO PARAGRAPHS ABOVE ARE READ THROUGH THEIR MARK, 2026-10-27 — THE ARCHITECT'S RULING, VERBATIM:
+/// *"Cache the restoreMark when opening a commit, based on the last valid state/op of the journal."*** `RCA-8(g)`
+/// ANNOTATE-BESIDE: **every byte above stands and this clause is the operative statement of WHICH mark the act
+/// names.** **THE HEAD IS NO LONGER TRUSTED, AND THE REASON IS THE MEASUREMENT `DEF-AE` FILED:** *"a reversal
+/// appends no journal entry, so the head describes the state that stood before the action"* is TRUE OF A REVERSAL
+/// TAKEN AT REST and FALSE OF ONE TAKEN INSIDE A WRITE'S COMMIT — **in the restart arm the enclosing write's own op
+/// stands at the head when the listener's reversal runs**, so the head described the WRITE'S LANDING and the
+/// compensation restored the refusal's own value: **the store stood at `7` where the attempt found `9`, and the
+/// write that reported the refusal had landed its value.** **SO THE ACT NAMES THE MARK ITS COMMIT CACHED AT ITS
+/// OPENING** — `state.mjs`'s `openCommit` reads the store's own `journalMark` (`src/store.rs`: the last VALID
+/// mark, which is the head at that instant and is named as a VALUE) and stands it on the window; `windowMark`
+/// answers it here, and the store's `restoreMark` replays to it. **THE INSTANT IS THE WHOLE FIX**: the opening
+/// precedes anything the commit lands, so the cached position is the state the attempt FOUND — the pre-attempt
+/// state, which is what a failed attempt owes back. **A JOIN RE-CACHES NOTHING** (`D-45`/`D-46` decide which
+/// openings are outermost: a repair's write and a pass's scope join, so they take the outermost mark and not a
+/// later one), and **a callback's own commit is its own opening with its own cache** (a listener body's call names
+/// nothing and opens, so the mark it restores to is where ITS window opened). **THE MARK IS OPAQUE HERE**: the
+/// store answered a carrier — `{k:'s', v:<op id>}`, or `{k:'F'}` for the FLOOR, the state the store was born with
+/// when the journal held no entry at the opening — and this act hands the very same carrier back. **NEITHER THE
+/// PACKAGE NOR THIS FUNCTION COMPOSES A POSITION.**
+///
+/// **AND A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED: THIS ACT REFUSES RATHER THAN FALLING BACK TO THE
+/// HEAD** — the head is the value this ruling exists to stop trusting, and a silent fall-back would restore it
+/// while a consumer was told the reversal was undone. **THE REFUSAL IS THE ACT'S, NOT THE CALL'S**: no store verb
+/// is invoked, no status is minted (`DD-40`), every address the reversal moved is reported as NOT restored with
+/// what stands there instead, and the log entry says the window carried no cached mark — so the crossed form, its
+/// `status` and its member set are unmoved and the consumer is never told a restoration happened that did not.
+///
 /// **WHAT THE CAPTURE SURVIVES AS, AND WHY IT IS NOT A FALLBACK.** `reversalWatch`'s per-tier capture is still
 /// taken, and it is the ONLY record of **what was owed** — it is the DEBT'S RECORD and the VERIFICATION
 /// BASELINE, not a write plan. Every address the reversal moved is read again after the store's act
@@ -1786,14 +1904,25 @@ export function judgeReversal(instance, watched, reversalId) {
 /// NO SECOND SAVE IS ATTEMPTED** — the store's answer is the whole report.
 function restoreReversal(instance, moved) {
   const addon_ = withAddon();
-  // THE ONE ACT: the store returns its own state to the state its journal's head describes. NO POSITION IS
-  // SUPPLIED — the boundary's codec folds an unsupplied position to the carrier's ABSENT arm, which is the
-  // store's own spelling for the head (`rollback`'s own absent-position rule, `crossing.md §1.3`).
+  // **THE ONE ACT: THE STORE RETURNS ITS OWN STATE TO THE MARK ITS COMMIT CACHED AT ITS OPENING** (`windowMark`,
+  // `state.mjs`) — NOT to the journal's head, which is the write's own landing on the restart arm. **THE CARRIER
+  // IS THE STORE'S OWN ANSWER, HANDED BACK VERBATIM**: `{k:'s', v:<op id>}` names an entry and `{k:'F'}` names the
+  // FLOOR (the state the store was born with, where the journal held no entry when the commit opened). **NOTHING
+  // IS COMPOSED HERE**, so the mark has one spelling and it lives at the store's edge.
   let refused = null;
-  try {
-    Reflect.apply(addon_.restoreMark, instance, []);
-  } catch (why) {
-    refused = why;
+  let cacheless = false;
+  const mark = windowMark(instance);
+  if (mark === undefined) {
+    // **A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED, AND THIS REFUSES RATHER THAN FALLING BACK TO THE
+    // HEAD.** No store verb is invoked, so the store holds the state it held — and the count below claims NO
+    // address restored, so the sentence that reaches the consumer says the reversal was not undone.
+    cacheless = true;
+  } else {
+    try {
+      Reflect.apply(addon_.restoreMark, instance, [mark]);
+    } catch (why) {
+      refused = why;
+    }
   }
   // **THE STORE'S ANSWER IS CLASSIFIED BEFORE ANY ADDRESS IS COUNTED — 2026-10-27, THE FILE-SAVE RULING.** A
   // REFUSED MARK leaves the store as it was, so no address may be claimed restored. **A FAILED SAVE does not**:
@@ -1801,9 +1930,10 @@ function restoreReversal(instance, moved) {
   // exactly as it is on the passing arm, and the file's own half is recorded beside the count (`unsaved`) for
   // the ONE sentence that names it. **THIS IS THE VERIFICATION EXTENDED TO THE FILE**: the restore already
   // counts the addresses it put back; the count is not narrowed by a failure that did not affect them, and the
-  // bytes are reported as the thing that did fail.
+  // bytes are reported as the thing that did fail. **AND THE CACHELESS ARM IS A THIRD, WHICH NEVER RESTORES**:
+  // no mark was supplied, so no address may be counted.
   const unsaved = saveRefused(refused);
-  const stateRestored = refused === null || unsaved !== null;
+  const stateRestored = cacheless === false && (refused === null || unsaved !== null);
   let restored = 0;
   const failed = [];
   // ONE VERIFICATION PER ADDRESS: two pairs over one address (or one pair naming it twice) must not be counted
@@ -1833,7 +1963,7 @@ function restoreReversal(instance, moved) {
       tiers: verdict.tiers,
     });
   }
-  return { restored, total: measured.length, failed, refused, unsaved };
+  return { restored, total: measured.length, failed, refused, unsaved, cacheless };
 }
 
 /// **WHETHER A LOCAL LIST OF SPELLINGS ALREADY HOLDS ONE** — a local index loop and not `Array.prototype.includes`.
@@ -1890,7 +2020,14 @@ function undoSpelling(undo) {
   // store's own (`restoreReversal`), so a refusal it answered is the FIRST thing a consumer must hear — its
   // status and its own generated message (`DD-52`) — and it is never spoken for by a claim about the state.
   let refusal = '';
-  if (undo.unsaved !== null && undo.unsaved !== undefined) {
+  if (undo.cacheless === true) {
+    // **⟶ AND THE CACHELESS ARM OPENS THE SENTENCE, 2026-10-27** (`restoreReversal` above): **a window with no
+    // cached journal mark is a window that never opened, and the act refused rather than falling back to the
+    // head.** No status is named — no store verb was reached and none refused — and the one fact a consumer must
+    // hear is that nothing was restored, which is what the count below then spells address by address.
+    refusal = 'the commit window this reversal ran in carries NO CACHED JOURNAL MARK, so the store was NOT asked '
+      + 'to restore it and holds the state the reversal left; ';
+  } else if (undo.unsaved !== null && undo.unsaved !== undefined) {
     // THE SAVE'S ARM: read as own data members and off no chain (`D-35`'s read half), exactly as the refused
     // mark's status and sentence are read below.
     const carried = typeof undo.unsaved === 'object';
@@ -1917,7 +2054,7 @@ function undoSpelling(undo) {
   for (let index = 0; index < undo.failed.length; index += 1) {
     const one = undo.failed[index];
     named += index === 0 ? '' : '; ';
-    named += `${JSON.stringify(one.address)} could not be restored and stands `
+    named += `${addressSpelling(one.address)} could not be restored and stands `
       + `${standingDescription(one.standing, one.tiers)} where it stood `
       + `${capturedDescription(one)} before the reversal`;
   }
@@ -2147,21 +2284,36 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
   let spelled;
   if (unsettled === true) {
     spelled = `the constraint ${one.entry.id} could not be asked a state that would settle at `
-      + `${JSON.stringify(one.address)}: the value there is ${standingSpelling(after)} — the check was `
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — the check was `
       + `restarted ${RESTART_LIMIT} times and a pair body acted inside the check at every restart, so the `
       + `restart budget is spent and the check does not pass — ${undoSpelling(undo)}`;
   } else if (thrown === null) {
     spelled = `the constraint ${one.entry.id} refused the state the reversal left at `
-      + `${JSON.stringify(one.address)}: the value there is ${standingSpelling(after)}`
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
       + (said === null ? '' : ` — ${said}`)
       + ` — ${undoSpelling(undo)}`;
   } else {
     spelled = `the constraint ${one.entry.id} THREW at the judgement of the state the reversal left at `
-      + `${JSON.stringify(one.address)}: the value there is ${standingSpelling(after)}`
+      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
       + ` — ${undoSpelling(undo)}`;
   }
   const entry = {
+    // **⟶ AND THE `seq` STANDS, 2026-10-28 — `DEF-AI`: THE ENTRY'S DECLARED SHAPE IS THE KERNEL'S CLOSED SIX
+    // AND THIS ONE CARRIED FIVE.** The 2026-10-27 clause below withdrew the `1` as FABRICATED, on the reading
+    // that `seq` is *"the ordinal within an ATTEMPT's own log"* and that no attempt stands at a reversal's
+    // judgement. **THE READING IS RIGHT ABOUT THE ATTEMPT AND WRONG ABOUT THE MEMBER.** `seq`'s DECLARED
+    // DOMAIN is *"the append ordinal, strictly increasing from `1` in array order"*
+    // (`docs/specs/storeroom-constraints/kernel-surface.md §2.5` item 1), and the array this entry stands in is
+    // THIS REFUSAL'S OWN ONE-ENTRY LIST: its first element's ordinal is `1` BY THAT RULE, not by invention —
+    // the same arithmetic the kernel's own `append` performs (`log.length + 1`, read off the list the entry
+    // stands in). **AND THE TWO COPIES OF THIS VERY ENTRY ALREADY DISAGREED**: `carryRestartRefusal` re-appends
+    // it into the attempt's log through `append`, where it carries `seq` `1`, while the list that crosses to
+    // the caller carried none — one entry, two shapes, which is this branch's `DEF-AI` class exactly. **`log`
+    // IS DECLARED `LogEntry[]`** (`bindings/js/index.d.ts`), so a consumer typing it read `undefined` where
+    // `number` is declared. **THE DECLARATION IS NOT WEAKENED TO MATCH THE ENTRY: THE ENTRY CARRIES THE
+    // MEMBER.** No other member, no second entry and no sentence moves.
     kind: 'constraint-check',
+    seq: 1,
     id: one.entry.id,
     // **⟶ AND THE ENTRY SAYS WHAT THE ACT DID, 2026-10-26 (`DEF-W`'s `(a)`) and 2026-10-27 (`D-41` item `2`)** —
     // the refusal's own record, beside the state it refused, so a consumer that catches it knows whether the

package/src/entry/delivery.mjs

@@ -5,6 +5,7 @@ import { withAddon, boundaryReject } from './artefact.mjs';
 import { arrayClass, classSpelling, hasLoneSurrogate, isPlainObjectValue, targetSpelling } from './class-decision.mjs';
 import { encodeAddress, encodeOpId, handleWire, inDomainHandle } from './carrier.mjs';
 import { decodeSegments, spellConstraintAddress } from './frame.mjs';
+import { addressSpelling } from './kernel-foundations.mjs';
 import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
 
 /// `PAR-JS-13`: the returned record is `{op, watched, triggered}` — fresh on every call, never a view.
@@ -305,8 +306,8 @@ export function registerOn(state, handle, listener) {
   if (conflicted !== null) {
     boundaryReject(
       'AddressMalformed',
-      spellConstraintAddress(conflicted.address),
-      `the listener '${handle}' cannot be registered at ${JSON.stringify(conflicted.address)}: the constraint `
+      addressSpelling(conflicted.address),
+      `the listener '${handle}' cannot be registered at ${addressSpelling(conflicted.address)}: the constraint `
         + `'${conflicted.id}' stands at that address, and a listener and a constraint do not share one`,
     );
   }

package/src/entry/frame.mjs

@@ -2,6 +2,7 @@
 import { types } from 'node:util';
 import { boundaryReject } from './artefact.mjs';
 import { appendOwn } from './refusal.mjs';
+import { addressSpelling } from './kernel-foundations.mjs';
 import { arrayClass, classSpelling, hasLoneSurrogate, isAdmittedArray, isLawfulListenerElement, isPlainObjectValue, valueTargetSpelling } from './class-decision.mjs';
 import { encodeAddress, encodeFilePath, encodeJournalLength } from './carrier.mjs';
 
@@ -309,7 +310,7 @@ export function admittedConstraintBatch(cfg) {
         'ConstraintListInvalid',
         segment,
         `the batch element at position ${position} names the handle '${element.id}', and this construction `
-          + `adopts a listener under that handle at ${JSON.stringify(adoptedAddresses[adoptedAt])}: a listener `
+          + `adopts a listener under that handle at ${addressSpelling(adoptedAddresses[adoptedAt])}: a listener `
           + 'and a constraint do not share one',
         ['constraints'],
       );

package/src/entry/kernel-attempt.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close } from './kernel-terminal.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-3` `runAttempt(store, commit) -> AttemptReport`
@@ -144,7 +144,7 @@ function passInCommitScope(store, commitRecord) {
   if (attempt.status === 'running') {
     // THE RE-ENTRANT `K-3`, refused by the SAME `KC-7` member a live address answers with.
     refuse(KC.attemptOpen,
-      `the constraint attempt at ${JSON.stringify(attempt.address)} is already running`, []);
+      `the constraint attempt at ${addressSpelling(attempt.address)} is already running`, []);
   }
 
   attempt.status = 'running';
@@ -242,7 +242,7 @@ function passInCommitScope(store, commitRecord) {
     terminal(kernel, attempt, KC.violated,
       typeof saveFailure.message === 'string'
         ? saveFailure.message
-        : `the attempt's own save at ${JSON.stringify(attempt.address)} failed`);
+        : `the attempt's own save at ${addressSpelling(attempt.address)} failed`);
     throw saveFailure;
   }
   // **THE `commit` ENTRY: THE ATTEMPT'S SUCCESS ARM, APPENDED ONCE, ON THIS ARM ALONE**
@@ -258,7 +258,7 @@ function passInCommitScope(store, commitRecord) {
   // before this line and reach this attempt's log by no act (`§2.7` item 6), the record this attempt's
   // report carries being the same list this line closes.
   append(attempt, 'commit', null, attempt.ops[attempt.ops.length - 1].opId,
-    `every constraint registered at ${JSON.stringify(attempt.address)} passed; the commit stands`);
+    `every constraint registered at ${addressSpelling(attempt.address)} passed; the commit stands`);
   return closed;
 }
 
@@ -423,7 +423,7 @@ function evaluate(kernel, attempt, landing) {
       let text;
       let repair = null;
       if (outcome === true) {
-        text = `the constraint ${pair.id} passed at ${JSON.stringify(attempt.address)}`;
+        text = `the constraint ${pair.id} passed at ${addressSpelling(attempt.address)}`;
       } else if (outcome !== null && typeof outcome === 'object' && Object.hasOwn(outcome, 'message')) {
         const outcomeMessage = ownMember(outcome, 'message');
         text = typeof outcomeMessage === 'string' && outcomeMessage.length > 0
@@ -612,7 +612,7 @@ function evaluate(kernel, attempt, landing) {
           : okMember === false
             && typeof messageMember === 'string' && messageMember.length > 0
             ? messageMember
-            : `the repair ${pair.id} produced no op at ${JSON.stringify(attempt.address)}`;
+            : `the repair ${pair.id} produced no op at ${addressSpelling(attempt.address)}`;
         entry.message = carried;
         return { terminal: { status: KC.repairFailed, message: carried }, rerun: false };
       }
@@ -757,6 +757,6 @@ function publishCheckedOff(attempt) {
  *  read off a member the row really holds, and no member of the sentence moves. */
 function unrecognized(pair) {
   return `the constraint ${pair.id} returned a value outside the three declared outcome arms at `
-    + `${JSON.stringify(pair.addresses[0])}`;
+    + `${addressSpelling(pair.addresses[0])}`;
 }
 

package/src/entry/kernel-commit.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9c`) — the commit act: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn } from './kernel-foundations.mjs';
+import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling } from './kernel-foundations.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-2` `commit(store, address, tier, value) -> CommitRecord`
 // ---------------------------------------------------------------------------------------------
@@ -20,7 +20,7 @@ export function commit(store, address, tier, value) {
   // HELD address WITHIN the instance is refused exactly as it stood. **THE ADDRESS COMPARISON ITSELF IS UNMOVED.**
   if (held && attemptHeldAt(kernel, address)) {
     refuse(KC.attemptOpen,
-      `a constraint attempt is already open at ${JSON.stringify(address)}; it is disposed of by its own `
+      `a constraint attempt is already open at ${addressSpelling(address)}; it is disposed of by its own `
       + 'K-3 and by no other act',
       []);
   }

package/src/entry/kernel-foundations.mjs

@@ -316,8 +316,32 @@ export function inDomainId(id) {
  * being the tuple.
  */
 export function pairSpelling(pair, address) {
-  return `${(address === undefined ? pair.addresses[0] : address).map((segment) => String(segment)).join('/')}`
-    + `#${pair.id}`;
+  return `${addressSpelling(address === undefined ? pair.addresses[0] : address)}#${pair.id}`;
+}
+
+/**
+ * **THE ADDRESS, SPELLED FOR THE KERNEL'S OWN SENTENCES — ONE RENDERING, DECLARED ONCE, AND THIS IS IT.**
+ *
+ * **`D-48`'s `DEF-AB` ROW IS THE MEASUREMENT THIS FUNCTION CLOSES: THE SAME ADDRESS WAS PRINTED TWO WAYS
+ * ACROSS TWO MESSAGES OF ONE RECORD.** `pairSpelling` above spells an address's segments joined by `/`
+ * (`a/b#x`); every other sentence the kernel built spelled the very same address through
+ * `JSON.stringify(address)` — `["a"]` — so one attempt's log carried *"the constraint `x` passed at
+ * `["a"]`"* beside *"the pair `a#x` violated a re-run …"*. **THE `DEF-Q` DEFECT CLASS AT ANOTHER SITE**, and
+ * the rendering that fixes it is the one `pairSpelling` already carried: **the address's segments joined by
+ * `/`, and never a JSON array.** There is now ONE spelling, ONE home, and both readers take it here.
+ *
+ * **IT TAKES THE SEGMENTS AS THE REGISTRY ROW AND THE JOURNAL OP CARRY THEM** — strings and non-negative
+ * integers — and renders a segment through `String` alone, exactly as `pairSpelling` always has: **no
+ * quoting, no bracketing and no second escaping rule is introduced, and no member of any sentence moves.**
+ * A local index loop is used, so no `Array.prototype.map`/`join` is read off a mutable prototype on a refusal
+ * path (`contract.md §2.1`'s clause of 2026-10-24 on `F7-1`).
+ */
+export function addressSpelling(address) {
+  let spelled = '';
+  for (let position = 0; position < address.length; position += 1) {
+    spelled += position === 0 ? `${String(address[position])}` : `/${String(address[position])}`;
+  }
+  return spelled;
 }
 
 /// **⟶ DELETED 2026-10-24 (`D-29`): `pairRowCarrying` HAD NO SUBJECT LEFT.** Its doc read: *"THE ROW A PAIR
@@ -703,7 +727,7 @@ export function landedOp(attempt, returned, invokedFor) {
  * — and never the attempt's address alone.
  */
 export function landedOpDefect(attempt, pair, returned) {
-  const where = JSON.stringify(attempt.address);
+  const where = addressSpelling(attempt.address);
   // **⟶ THE MEMBER IS READ AS THE RETURN'S OWN HERE TOO** (`D-35`'s read half): the arm that names *"carried no
   // op"* and the arm that spells the op must agree with `landedOp`'s own answer, and a chain read would let a
   // prototype decide which of the two sentences the caller is handed.

package/src/entry/state.mjs

@@ -290,10 +290,13 @@ export function externalCall(store, run) {
   return run();
 }
 
-/** The per-store index: `{ open, observers, windows, windowSeq }`, keyed by the store instance and by nothing
- *  else. **`windows` IS THE STACK OF OPEN WINDOW IDENTITIES** — one number per commit this store opened, the
+/** The per-store index: `{ open, observers, windows, marks, windowSeq }`, keyed by the store instance and by
+ *  nothing else. **`windows` IS THE STACK OF OPEN WINDOW IDENTITIES** — one number per commit this store opened, the
  *  top being the window in flight — and it exists so a restart request can name the window that raised it
- *  (`D-42`'s *"a request belongs to the act that raised it"*, made a measurement instead of an inference). */
+ *  (`D-42`'s *"a request belongs to the act that raised it"*, made a measurement instead of an inference).
+ *  **`marks` IS THE STACK BESIDE IT AND IT IS THE SAME ONE STACK READ AS THE JOURNAL MARK** — one entry per commit
+ *  that OPENED, pushed and popped in lockstep with `windows` (`openCommit`/`closeCommit`), so `windowMark` answers
+ *  the outermost opening's mark and a join neither pushes nor pops. */
 const ATTEMPT_INDEX = new WeakMap();
 
 function attemptIndex(store) {
@@ -308,7 +311,7 @@ function attemptIndex(store) {
     // refusal.** The list preserves the Set's own two facts — insertion order and uniqueness — and the copy
     // is taken before any notification, so an observer that removes itself mid-notification still moves
     // nothing.
-    index = { open: 0, observers: [], windows: [], externalAt: [], windowSeq: 0 };
+    index = { open: 0, observers: [], windows: [], marks: [], externalAt: [], windowSeq: 0 };
     ATTEMPT_INDEX.set(store, index);
   }
   return index;
@@ -354,6 +357,54 @@ export function currentWindow(store) {
   return windows.length === 0 ? 0 : windows[windows.length - 1];
 }
 
+/// **⟶ ADDED 2026-10-27 — THE MARK THE WINDOW IN FLIGHT CACHED AT ITS OPENING, AND `undefined` WHERE NO COMMIT
+/// IS OPEN.**
+///
+/// **THE RULING IT CARRIES, THE ARCHITECT, VERBATIM: *"Cache the restoreMark when opening a commit, based on the
+/// last valid state/op of the journal."*** **THE DEFECT IT CLOSES IS `DEF-AE`'s AND IT IS A DATA-INTEGRITY ONE:**
+/// the refused reversal's restore named **the journal's HEAD**, on the reasoning that *"a reversal appends no
+/// journal entry, so that head describes the state that stood BEFORE the action"* — **a reasoning that fails on
+/// exactly one arm**. In the restart arm the ENCLOSING WRITE'S OWN OP STANDS AT THE HEAD when the listener's
+/// reversal runs, so the compensation restored **the write's landing, not the pre-attempt state**: a write that
+/// reported refusal left its own value standing (`9 → 7`).
+///
+/// **SO THE MARK IS TAKEN WHERE IT IS TRUE AND NOT WHERE IT IS NEEDED.** Every commit that OPENS reads the store's
+/// last valid mark (`withAddon().journalMark`, the store's own `journalMark`) and stands it on the window beside
+/// the window's identity. **THE INSTANT IS THE WHOLE POINT**: at an outermost opening nothing of the attempt has
+/// landed yet, so the mark names the state the commit FOUND. A JOIN IS THE SAME ACT AND RE-CACHES NOTHING — a join
+/// appends no window and no mark, so the cache in flight stays the outermost opening's — which is what makes a
+/// repair's write (a join, `D-46`) and a pass's scope (a join on the production path, `D-44`) read the attempt's
+/// own position rather than a later one. **A CALLBACK'S OWN COMMIT IS ITS OWN OPENING WITH ITS OWN CACHE**
+/// (`D-45`/`D-46`: a listener body's call names nothing and opens), so the mark a listener's own attempt restores
+/// to is where ITS window opened.
+///
+/// **A WINDOW WITH NO CACHE IS A WINDOW THAT NEVER OPENED, AND `undefined` IS ITS SPELLING.** The store answers
+/// `{k:'s', v:<op id>}` where the journal holds an entry and `{k:'F'}` where it holds none (the FLOOR — the state
+/// the store was born with); `undefined` means the read could not answer at all (a store whose artefact could not
+/// be reached), and the refused-reversal restore REFUSES rather than falling back to the head
+/// (`constraints.mjs`'s `restoreReversal` states that arm). **THE MARK IS OPAQUE HERE**: this file caches the
+/// store's own carrier and never composes a position of its own.
+export function windowMark(store) {
+  const index = attemptIndex(store);
+  if (index.windows.length === 0) return undefined;
+  return index.marks[index.marks.length - 1];
+}
+
+/// **THE MARK THE OPENING TAKES** — the store's own read, once per commit that OPENS and never per join. **IT IS
+/// TAKEN THROUGH THE ENTRY THE ADDON PUBLISHES** (`journalMark`), bound to the store object exactly as every other
+/// addon call is (`commitFile` above is the same form). **A READ THAT THROWS IS A WINDOW WITH NO CACHE AND NOT A
+/// REFUSED CALL**: the opening is not the act the consumer asked for, and refusing the consumer's verb because the
+/// journal read failed would answer a form the verb does not declare — so the arm answers `undefined`, the window
+/// stands without a cache, and the one consumer that needs the mark refuses its own restore instead.
+function journalMarkAtOpening(store) {
+  try {
+    const addon_ = withAddon();
+    return Reflect.apply(addon_.journalMark, store, []);
+  } catch (unanswered) {
+    return undefined;
+  }
+}
+
 /** **THE INCREMENT MOMENT** (`PAR-ADA-15`): the opening of a commit. It is taken iff THIS call opens one —
  *  a call that finds the count already above zero has joined an extant commit and opens nothing.
  *
@@ -396,6 +447,14 @@ export function openCommit(store, commit) {
   // kept exact in the identity too, and no window id is ever reused.
   index.windowSeq += 1;
   appendOwn(index.windows, index.windowSeq);
+  // **⟶ AND THE MARK THE OPENING TAKES, 2026-10-27 — THE ARCHITECT'S RULING: *"Cache the restoreMark when opening
+  // a commit, based on the last valid state/op of the journal."*** **THE CACHE IS TAKEN HERE AND ONLY HERE**: this
+  // is the arm that OPENS (a join returned above and takes nothing), so the store's read names the journal's
+  // position at the instant the commit was entered — before anything the commit will land has landed. **IT IS
+  // TAKEN BEFORE THE OBSERVERS FIRE** (the notification below is part of the opening, and an observer that acts
+  // would open its own commit; this window's mark is the one that stood when the window itself opened). It is
+  // pushed in lockstep with `windows` so the two stacks are one stack, and `closeCommit` releases it with it.
+  appendOwn(index.marks, journalMarkAtOpening(store));
   // **AND THE DEPTH FALLBACK'S OWN RECORD IS STOOD BESIDE IT**: the depth this commit was opened at, in lockstep
   // with `windows`, so the next unnamed call can tell the package's own continuation from a callback's act.
   appendOwn(index.externalAt, EXTERNAL_DEPTH);
@@ -419,15 +478,20 @@ export function closeCommit(store, opened) {
   // prototype's `slice`/`pop` (`contract.md §2.1`'s clause of 2026-10-24 on `F7-1`/`F8-2`). A joining call
   // opened nothing and releases nothing, so the enclosing window's identity stands. **AND THE DEPTH STOOD BESIDE
   // IT GOES WITH IT, IN THE SAME LOOP AND AT THE SAME INSTANT**: the two stacks are one stack read two ways, so a
-  // commit's depth can never be left standing for a commit that has closed.
+  // commit's depth can never be left standing for a commit that has closed. **AND THE MARK THE OPENING CACHED
+  // GOES WITH IT IN THAT SAME LOOP** — `windows`, `externalAt` and `marks` are one stack read three ways, so no
+  // closed window's journal position can be answered to a later act.
   const kept = [];
   const keptAt = [];
+  const keptMark = [];
   for (let i = 0; i + 1 < index.windows.length; i += 1) {
     appendOwn(kept, index.windows[i]);
     appendOwn(keptAt, index.externalAt[i]);
+    appendOwn(keptMark, index.marks[i]);
   }
   index.windows = kept;
   index.externalAt = keptAt;
+  index.marks = keptMark;
 }
 
 /// **THE TWO CHANNELS, INSTALLED ONCE ON THE OBJECT `storeCreate` RETURNS** (`§4.2` item 4: *"`storeCreate`