provident-storeroom 1.2.0 → 1.3.0

package/src/entry/constraints.mjs

@@ -72,11 +72,16 @@ export function constraintsKernel() {
   return KERNEL;
 }
 
-/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-8`, read HERE for their ONE use: to tell a
+/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-9`, read HERE for their ONE use: to tell a
 /// refusal the KERNEL raised from one a STORE VERB raised, so that `A120` (2) can be applied to the first
 /// and not to the second. **NO `KC` SPELLING CROSSES THIS SURFACE** (`docs/specs/storeroom-js/surface.md §2.12` item 1's read-through clause:
 /// printed here it would be a second, unowned home for the kernel's own vocabulary).
-const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8'];
+///
+/// **⟶ AND THE LIST MOVES `8 → 9` WITH THE SET ITSELF, 2026-10-28 (`D-53`: *"Open the token set"*).** The ninth
+/// member is the SAVE ARM's (`KC-9`, `kernel-foundations.mjs`'s `KC.saveFailed`); **this list must carry it or a
+/// kernel refusal carrying `KC-9` in `state` would be read here as a STORE code** and cross converted, which is the
+/// one thing this predicate exists to prevent.
+const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8', 'KC-9'];
 
 /// **⟶ THE PAIR'S OWN KEY IS `(id, address-set)` — `U-STOREROOM-HELD-LISTENER-IDENTITY` (`D-GP-SHLI`).**
 /// **ONE PAIR OVER N ADDRESSES IS ONE PAIR: ONE `id`, N ADDRESSES, ONE row of `constraints()`** (`P:
@@ -484,7 +489,7 @@ export function registrationCrossing(refusal) {
   // is the caller's own value and is answered as it was thrown.
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried);
+    const converted = bodyThrowRefusal(carried, refusal);
     if (converted !== null) throw converted;
   }
   if (isKernelBuiltRefusal(refusal) === false) throw refusal;
@@ -505,11 +510,11 @@ export function registrationCrossing(refusal) {
   // keeps its own trigger and its own sentence) — the `message` the STORE'S OWN GENERATED SENTENCE, and the
   // `log` the synthetic attempt's log where a repair was attempted and `[]` where none was. **NO `KC` TOKEN CROSSES** (`A120` (2); `docs/specs/storeroom-js/surface.md §2.12` item 3 item 2): the synthetic attempt's
   // terminal token stays in the kernel and reaches no caller.
-  throw {
+  throw packageRefusal({
     status: refusal.status,
     message: generated,
     log: refusalLog(refusal.log),
-  };
+  });
 }
 
 /// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
@@ -1013,6 +1018,91 @@ function bodyThrowCarried(value) {
   return carried;
 }
 
+/// **⟶ ADDED 2026-10-28 — `DEF-AK`: THE INNER REFUSAL A CONSTRAINT BODY SWALLOWED AND THE CARRIER THAT PUTS
+/// IT BESIDE THE CROSSED ONE.**
+///
+/// **THE MEASUREMENT, STATED AS MEASURED.** A LISTENER body propagates an inner refusal VERBATIM — same
+/// `status`, same `message`, same two-entry `log`, same op — because no kernel frame catches a listener's body
+/// and nothing marks it. **A CONSTRAINT body making the IDENTICAL write had it REPLACED by the generated
+/// `ConstraintBodyThrew` form** (the set's rank `18`), whose single log entry was the OUTER attempt's and in
+/// which **the inner refusal's distinctive literal occurred ZERO TIMES**. **So the host you were inside decided
+/// what you were told**, and the crossed sentence's own *"a constraint body's throwable crosses as this
+/// refusal"* promised a carriage the crossing did not make.
+///
+/// **WHAT MOVES, AND WHAT DOES NOT.** `ConstraintBodyThrew` STAYS THE STATUS THAT CROSSES (the body did
+/// throw, and `DEF-S`'s ruling is unmoved); **the inner refusal — its `status`, its `message` and its own `log`
+/// — is carried BESIDE the crossed one** under this `Symbol.for` key, which both sides can spell and which
+/// `Object.keys` and `Object.getOwnPropertyNames` do not see. **The crossed `message` names the inner status,
+/// quotes the inner message and says in its own words that the value the body threw does NOT cross as the
+/// crossed refusal** — so the crossed sentence no longer claims more than it delivers, and the literal is in
+/// the text a consumer reads first. **NO MEMBER OF THE CROSSED FORM MOVES** (`{status, message, log}`, three
+/// own enumerable members), **the rank-`18` member is not renamed, no status is minted** (`DD-40`) and **an
+/// UNMARKED value still crosses as itself** (`DEF-A`'s protection, unmoved).
+const INNER_REFUSAL = Symbol.for('provident-storeroom.inner-refusal');
+
+/// **⟶ AND THE PROVENANCE MARK THAT MAKES AN INNER REFUSAL AN INNER REFUSAL, 2026-10-28 — `DEF-AK`, AND IT IS
+/// THE WHOLE REASON A SHAPE TEST CANNOT DO.**
+///
+/// **A CALLER'S BODY IS THE CALLER'S CODE, so a value it throws may carry `{status, message, log}` and be a
+/// FORGERY.** `DEF-A`'s protection — a forged refusal must never be answered as the package's own — has a
+/// second consequence here: **a forged shape must not have its text quoted back inside the package's crossed
+/// sentence either.** Measured on this pass's first cut: a constraint body throwing
+/// `{status: 'ValueNotAdmitted', message: 'the caller forged this refusal', log: []}` had the forged text
+/// printed in the crossed message as though the package had found a refusal there, which is the same
+/// laundering `DEF-A` closed one layer out.
+///
+/// **SO AN INNER REFUSAL IS IDENTIFIED BY A MARK THIS PACKAGE SETS ON THE FORMS IT BUILDS**, spelled here
+/// under a `Symbol.for` key exactly as `KERNEL_REFUSAL` and `CONSTRAINT_BODY_THREW_ENTRY` are, and never by a
+/// member a caller can spell. The kernel's own refusals (`isKernelBuiltRefusal`) count too: both are the
+/// store's forms, and a caller's value is neither.
+const PACKAGE_REFUSAL = Symbol.for('provident-storeroom.package-refusal');
+
+/// **THE ONE PLACE THIS FILE'S OWN REFUSAL FORMS ARE MARKED** — the three crossing arms and the judgement's
+/// own form reach it, so a refusal built here and then caught from a body is recognisable as the store's and
+/// never as a caller's. **NO MEMBER MOVES**: the mark is a symbol-keyed, non-enumerable own data member, so
+/// `Object.keys` still reads `["log","message","status"]` and no census of the three sees it.
+function packageRefusal(form) {
+  Object.defineProperty(form, PACKAGE_REFUSAL, {
+    value: true,
+    writable: false,
+    enumerable: false,
+    configurable: true,
+  });
+  return form;
+}
+
+/// **THE INNER REFUSAL A BODY'S THROWABLE CARRIES, OR `null`** — asked of the value the frame that CAUGHT it
+/// from the body has in hand, so the identity question is already answered: this reads the value's OWN data
+/// members (`D-35`'s read half) and answers the value only where it carries the surface's own refusal form —
+/// a non-empty `status` string, a `message` string and a `log` array. **A BODY THAT THREW SOMETHING ELSE IS
+/// `null`** (a `TypeError`, a string, a bare object with no `log`), and the crossed sentence then stands as
+/// the generated one: the throwable is not a refusal, there is no inner refusal to carry beside the crossed
+/// one, and nothing is invented for it.
+function innerRefusalThrown(thrown) {
+  if (thrown === null || typeof thrown !== 'object') return null;
+  // **THE PROVENANCE TEST COMES FIRST AND IS THE MARK, NOT THE SHAPE** (`PACKAGE_REFUSAL` above): a refusal
+  // this package built, or one the kernel built, is the store's; anything else — including a caller's forged
+  // three-member object — is not, and the crossed sentence never quotes a value it cannot attribute.
+  if (thrown[PACKAGE_REFUSAL] !== true && isKernelBuiltRefusal(thrown) === false) return null;
+  const status = ownDataMember(thrown, 'status');
+  const message = ownDataMember(thrown, 'message');
+  const log = ownDataMember(thrown, 'log');
+  if (typeof status !== 'string' || status.length === 0) return null;
+  if (typeof message !== 'string' || message.length === 0) return null;
+  if (Array.isArray(log) === false) return null;
+  return thrown;
+}
+
+/// **THE INNER REFUSAL A CROSSED REFUSAL CARRIES BESIDE IT, OR `null`** — the mark's read half, taken off
+/// the value this package BUILT and never off a caller's shape: the fact travels under the `Symbol.for` key
+/// above, so no member a caller can spell decides it.
+function innerRefusalCarried(value) {
+  if (value === null || typeof value !== 'object') return null;
+  const carried = value[INNER_REFUSAL];
+  if (carried === null || typeof carried !== 'object') return null;
+  return carried;
+}
+
 /// **THE ONE FAILURE FORM FOR A BODY'S THROW** — `{status, message, log}`, `§2.5` items 3–4's form at this arm
 /// too: the `status` the set's rank-`18` member, the `message` the STORE'S OWN GENERATED sentence (reached
 /// through the generator this package already holds, `addon_.errorMessage` — `DD-52` forbids a second source),
@@ -1021,17 +1111,43 @@ function bodyThrowCarried(value) {
 /// **A TREE THAT CARRIES NO USABLE GENERATOR ANSWERS `null`**, and both crossings then re-throw the marked
 /// value AS ITSELF — the same safe direction `registrationCrossing` takes for a kernel refusal, and no
 /// sentence is authored here.
-function bodyThrowRefusal(carried) {
+function bodyThrowRefusal(carried, thrown) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') return null;
   const subject = typeof carried.address === 'string' ? carried.address : '';
-  const generated = addon_.errorMessage(BODY_THREW_STATUS, subject);
+  let generated = addon_.errorMessage(BODY_THREW_STATUS, subject);
   if (typeof generated !== 'string' || generated.length === 0) return null;
-  return {
+  // **⟶ `DEF-AK`, 2026-10-28: THE INNER REFUSAL IS CARRIED BESIDE THE CROSSED ONE AND THE SENTENCE SAYS SO.**
+  // The value this frame was handed is the very value the body threw (the frame above caught it and marked it),
+  // so the inner refusal is in hand: where it carries the surface's own form, the generated sentence — whose
+  // own words are *"a constraint body's throwable crosses as this refusal"* — is followed by the clause that
+  // stops it claiming more than the crossing delivers, and the value itself travels under `INNER_REFUSAL`.
+  const inner = innerRefusalThrown(thrown);
+  if (inner !== null) {
+    const innerStatus = ownDataMember(inner, 'status');
+    const innerSaid = ownDataMember(inner, 'message');
+    generated = `${generated} — the value the constraint body threw does NOT cross as this refusal: it was `
+      + `ITSELF a refusal, ${JSON.stringify(innerStatus)} with the message ${JSON.stringify(innerSaid)}, and it `
+      + `crosses BESIDE this one under Symbol.for('provident-storeroom.inner-refusal') with its own log — the `
+      + `generated sentence above names the CODE for a body that threw and not the value the body threw`;
+  }
+  const crossed = {
     status: BODY_THREW_STATUS,
     message: generated,
     log: refusalLog(carried.log),
   };
+  packageRefusal(crossed);
+  if (inner !== null) {
+    // A SYMBOL-KEYED, NON-ENUMERABLE OWN MEMBER: `Object.keys` and `Object.getOwnPropertyNames` read the
+    // crossed form's three members exactly as they did, and the inner refusal is reachable by its name.
+    Object.defineProperty(crossed, INNER_REFUSAL, {
+      value: inner,
+      writable: false,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  return crossed;
 }
 
 function constraintCrossing(refusal) {
@@ -1043,7 +1159,7 @@ function constraintCrossing(refusal) {
   // `{status, message}` AND NO MARK STILL CROSSES AS ITSELF, BELOW.**
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried);
+    const converted = bodyThrowRefusal(carried, refusal);
     if (converted !== null) throw converted;
   }
   const isObject = refusal !== null && typeof refusal === 'object';
@@ -1076,11 +1192,11 @@ function constraintCrossing(refusal) {
     }
   }
   if (typeof status !== 'string' || kernelToken === false) {
-    throw {
+    throw packageRefusal({
       status: refusal.status,
       message: refusal.message,
       log: refusalLog(log),
-    };
+    });
   }
   // **THE KERNEL'S OWN `KC` REFUSAL.** Its `{status, message, log}` is the KERNEL'S OWN three-member form
   // (`docs/specs/storeroom-constraints/fail-surface.md §1.1`), and **⟶ FROM 2026-10-26 IT CROSSES WITH THE
@@ -1089,13 +1205,13 @@ function constraintCrossing(refusal) {
   // **THE TOKEN STILL DOES NOT ENTER `status`** — it is on the attempt's own `outcome` entry's `state` in the
   // `log`, which is `D-38`'s reading — **AND `FileCommitFailed` IS NOW THE SAVE'S CODE ALONE, minted by save
   // failures only.** The message is the kernel's own, UNMOVED; the `log` is the attempt's, VERBATIM.
-  throw {
+  throw packageRefusal({
     status: CONSTRAINT_PASS_REFUSED,
     message: typeof refusal.message === 'string'
       ? refusal.message
       : 'the write was refused by a constraint of this attempt',
     log: refusalLog(log),
-  };
+  });
 }
 
 
@@ -1336,10 +1452,16 @@ function reversalAtRest(instance) {
 /// the store object, so a second store is a second record, the record dies with its store, and **NO MEMBER IS
 /// ADDED TO THE PRODUCT, TO A RECORD OR TO THE KERNEL** (`A117` (D6)'s four-member guardrail is untouched).
 ///
-/// **`pending` IS THE REQUEST** — `{ watched, reversalId, window }`:
+/// **`pending` IS THE REQUEST** — `{ watched, reversalId, window, asked }`:
 ///   * `watched` the check's own beginning captured BEFORE the action ran (`reversalWatch`);
 ///   * `reversalId` the store's own echo of the id the reversal named (attached by `judgeReversal` in the same
 ///     frame, one line after the action);
+///   * **⟶ `asked` THE PAIR THAT WAS BEING ASKED WHEN THE ACTION WAS RAISED, OR `null`, ADDED 2026-10-28 —
+///     `DEF-AL`, THE MISATTRIBUTION.** The budget's refusal used to name `watched[0]` — the FIRST WATCHED
+///     ADDRESS — so **registration order decided the accusation**: measured, the pair it named had answered
+///     `true` on every ask it received. **The ask in flight is known at the instant the request is raised**
+///     (`ASKING` below, set by `judgeReversal` around the one body invocation and read here), so the request
+///     records the pair and the address the check was actually at, and the arm past the budget names THOSE.
 ///   * **⟶ `window` the IDENTITY OF THE COMMIT THE ACTION WAS TAKEN IN** (`state.mjs`'s `currentWindow`, minted
 ///     with the opening and answered by every joining call), **ADDED 2026-10-27 — AND IT IS WHAT RETIRES THE
 ///     COUNTING FRAME.** `D-42`'s own sentence is *"a request belongs to the act that raised it"*; while the
@@ -1352,6 +1474,26 @@ function reversalAtRest(instance) {
 ///     by the enclosing pass's) still belongs to that window and is still consumed.
 const RESTARTS = new WeakMap();
 
+/// **⟶ `D-54` (b)'s ONE FLAG, SPELLED HERE AND IN `kernel-attempt.mjs`** — the `Symbol.for` key the kernel's
+/// terminal act stands on its own record while its compensating composition runs, so `reversalWatch` can tell
+/// the package's own undo from a consumer's `rollback` member call (`D-42`: *"a restart is only ever raised by a
+/// consumer's own `rollback` member call"*). **A SYMBOL ON THE KERNEL RECORD AND NOT A MEMBER OF THE PRODUCT OR
+/// OF ANY RECORD** (`A117` (D6)), no kernel item is minted (`kernel-surface.md §1` item 2), and the flag stands
+/// only for the duration of that one call.
+const COMPENSATING = Symbol.for('provident-storeroom.compensating-rollback');
+
+/// **⟶ THE ASK IN FLIGHT, 2026-10-28 — `DEF-AL`'s ONE NEW READ, AND IT IS A `WeakMap` FOR THE SAME REASONS
+/// THE RESTART RECORD IS ONE** (`D-30`; `D-46`): keyed by the store, so a second store is a second record, the
+/// record dies with its store, and no member is added to the product, to a record or to the kernel.
+///
+/// **WHAT IT CARRIES, AND WHY IT CANNOT LIVE ON THE REQUEST ALONE.** `{ entry, address }` — the pair
+/// `judgeReversal` is asking and the address it is asking at — set immediately BEFORE the one body invocation
+/// and cleared immediately after it, on every arm including the throwing one. **A body that raises a reversal
+/// does it INSIDE that invocation**, so `reversalWatch`'s in-flight arm reads the entry standing here and
+/// stamps it on the request it raises. Without it the arm past the budget has nothing to name but the watch's
+/// first address, which is a fact about registration order and not about the check.
+const ASKING = new WeakMap();
+
 /// **HOW MANY RESTARTS ONE PASS'S COMMIT SCOPE MAY TAKE** — the bound `drainRestartRequests` spends. Three is
 /// the declared figure: two fewer than any arm of this package's own batteries drives, and enough that a lawful
 /// in-commit action's single restart never meets it.
@@ -1428,29 +1570,38 @@ export function drainRestartRequests(instance, report) {
   for (;;) {
     const request = record.pending;
     if (request === null) return report;
-    // **A REQUEST BELONGS TO THE ACT THAT RAISED IT — MEASURED** (`D-42` item `3`'s closing sentence): a request
-    // standing from a window this pass did not open has no consumer HERE, and it is dropped rather than
-    // attributed to an unrelated check. **IT DIES WITH ITS WINDOW, AND THAT IS THE DECLARED FAIL-STATE**
-    // (`D-43` item `2`: the file reloads or the client regenerates the store). **TWO WINDOWS HOLD A COMMIT AND
-    // RUN NO PASS, AND THEY ARE NAMED RATHER THAN LEFT TO A MEASUREMENT**: a `delete`'s listener delivery (a
-    // delete consults no constraint, `D-1-bis`) and a REGISTRATION's own evaluation (`addConstraint`/
-    // `register`, whose body is asked at an instant no attempt of the pass kind stands at — `context.attempt`
-    // is `null` there). A request raised by a body inside either one has no consumer and dies here.
-    if (request.window !== window) {
-      record.pending = null;
-      return report;
-    }
+    // **A PASS DOES NOT CONSUME A REQUEST IT DID NOT RAISE — `D-54`, 2026-10-28, MEASURED.**
+    // `RCA-8(g)` ANNOTATE-BESIDE: the bytes that stood here read *"a request standing from a window this pass
+    // did not open has no consumer HERE, and it is dropped"*, and **the drop was a CONSUMPTION**: a nested
+    // pass — a listener body's own write, a reentrant write inside an open commit — cleared a request the
+    // ENCLOSING window had raised, so the enclosing pass's own drain found nothing to judge and the reversal's
+    // effect stood. **THE REQUEST IS THEREFORE LEFT WHERE IT STANDS**: this pass asks nothing at it and takes
+    // nothing from it, and the consumer that matches its window is still free to reach it. **A REQUEST NOBODY
+    // CONSUMES STILL DIES WITH ITS WINDOW** (`D-42` item `3`; `D-43` item `2`): windows are never reused, so a
+    // stale stamp can be consumed by no later pass, it is overwritten by the next action's own request, and the
+    // two declared passless windows have their own answers — the `delete`'s witness reports (and clears) its
+    // own, the registration's is read by no surface. **A MISMATCHED REQUEST IS NOT CONSUMED, AND THAT IS THE
+    // WHOLE OF HALF (a).**
+    if (request.window !== window) return report;
     record.pending = null;
     if (request.watched.length === 0) continue;
     rounds += 1;
     if (rounds > RESTART_LIMIT) {
       // THE CHECK DID NOT SETTLE: THE SAME FORM, THE SAME STATUS, THE SAME COMPENSATION (`D-41` item `4`'s
       // direction), and the log entry says the budget was spent rather than that a pair refused.
-      const one = request.watched[0];
+      //
+      // **⟶ AND IT NAMES THE ADDRESS THE BUDGET WAS SPENT AT AND THE PAIR THAT WAS BEING ASKED, 2026-10-28 —
+      // `DEF-AL`, MEASURED.** This arm named `request.watched[0]` — the FIRST WATCHED ADDRESS — so
+      // REGISTRATION ORDER DECIDED THE ACCUSATION, and the pair it named had answered `true` on every ask it
+      // received: `log[0]` named the true cause while naming a passing pair by id. **THE REQUEST'S OWN
+      // `asked` IS THAT PAIR** (`reversalWatch`'s clause above), and it is the one the check was at when it
+      // ran out. Where no ask stood, the entry says so and names no pair it cannot know.
+      const asked = request.asked !== null && request.asked !== undefined ? request.asked : null;
+      const one = asked === null ? request.watched[0] : { entry: asked.entry, address: asked.address };
       const after = standingAt(instance, one.address);
       const undo = restoreReversal(instance, request.watched);
       return carryRestartRefusal(report,
-        reversalRefusal(one, after, null, request.reversalId, undo, null, true));
+        reversalRefusal(one, after, null, request.reversalId, undo, null, true, asked !== null));
     }
     try {
       judgeReversal(instance, request.watched, request.reversalId);
@@ -1476,11 +1627,13 @@ export function drainRestartRequests(instance, report) {
 /// **WHAT THIS FUNCTION IS, AND WHAT IT IS NOT.**
 ///   * **IT RUNS NO PASS, NO BODY AND NO JUDGEMENT.** It reads the instance's own restart record — the record
 ///     `reversalWatch` raised the request in — and answers a fresh copy of the two facts a consumer needs: the
-///     id the reversal named (`reversalId`, the store's own echo) and the addresses the discarded check would
-///     have been asked at (`the watch's addresses`, deduplicated by spelling and copied segment for segment).
-///     **THE STORE IS NOT TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS
-///     MOVED** — the `D-49` bar: *"a witness is not a refusal: the act still answers what it answered, the
-///     discard is reported beside it, and nothing new is minted in the closed status set."*
+///     id the reversal named (`reversalId`, the store's own echo) and **the addresses the refused act MOVED**
+///     (`request.moved`, measured by `judgeReversal` at the reversal's own instant and deduplicated by spelling,
+///     segment for segment). **THE WATCH'S FULL ADDRESS LIST IS THE DEBT RECORD AND IS NOT THE WITNESS**: naming
+///     every watched address would say nothing about what the act did (`DEF-AM`, 2026-10-28). **THE STORE IS NOT
+///     TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS MOVED** — the `D-49`
+///     bar: *"a witness is not a refusal: the act still answers what it answered, the discard is reported beside
+///     it, and nothing new is minted in the closed status set."*
 ///   * **IT CONSUMES THE REQUEST IT REPORTS.** A request whose window is the caller's has no consumer that could
 ///     ever run it (the window's act ran no pass, and a later pass compares the identity and drops it — the
 ///     drain's own arm), so clearing the slot here moves no behaviour: it is the same clearing the drain would
@@ -1507,10 +1660,16 @@ export function witnessDiscardedReversal(instance, window) {
   // 2026-10-27): a request standing from another window is that window's and is left where it stands.
   if (request.window !== window) return null;
   record.pending = null;
+  // **⟶ AND THE ADDRESSES ARE THE ONES THE REFUSED ACT MOVED, NOT THE WHOLE WATCHED REGISTRY — `DEF-AM`,
+  // 2026-10-28.** The request's `watched` is the DEBT record and names every enabled pair's every address;
+  // `moved` is what `judgeReversal` measured at the reversal's own instant (`movedStanding`) and is the only
+  // answer a witness owes. **A WITNESS THAT NAMES EVERY ADDRESS THE REGISTRY WATCHES NAME NOTHING**: the
+  // discarded check's subject is the state the reversal changed.
+  const subject = Array.isArray(request.moved) ? request.moved : [];
   const addresses = [];
   const spellings = [];
-  for (let index = 0; index < request.watched.length; index += 1) {
-    const address = request.watched[index].address;
+  for (let index = 0; index < subject.length; index += 1) {
+    const address = subject[index].address;
     const spelling = homeAddressKey(address);
     let seen = false;
     for (let known = 0; known < spellings.length; known += 1) {
@@ -1574,7 +1733,14 @@ function carryRestartRefusal(report, refusal) {
   const log = { log: report.log };
   for (let index = 0; index < carried.length; index += 1) {
     const entry = carried[index];
-    append(log, entry.kind, entry.id, entry.opId, entry.message, entry.state);
+    // **⟶ AND THE REPLAY NAMES THE ITERATION AS THE ENTRY IT IS CARRYING NAMES IT — `D-53`'s first ruling.** This is
+    // the ONE `append` site whose two identities come from a CARRIED ENTRY and not from an acted-upon pair and op
+    // (`D-52` counted it as rule 1's fourth kind), so the iteration is rebuilt from the two identities the entry
+    // itself carries: **the pair stands by its `id`, and the op by the `opId` the judgement's reversal answered —
+    // and the pair's own row is not in hand here, which is why the identity alone is spelled.** Nothing is
+    // renumbered and nothing is re-authored: the entry minted here is the report's own, by the report's own
+    // ordinal, and its two identity columns read exactly what the entry it carries read.
+    append(log, entry.kind, { pair: { id: entry.id }, op: { opId: entry.opId } }, entry.message, entry.state);
   }
   Object.defineProperty(report, RESTART_REFUSAL, {
     value: refusal,
@@ -1639,10 +1805,32 @@ export function reversalWatch(state, instance) {
   // runs in, so *"a request belongs to the act that raised it"* (`D-42` item `3`) is MEASURED at this line and
   // checked at that one, and the `CHECK_DEPTH` frame that once approximated it is deleted with its clears.
   if (reversalAtRest(instance) === false) {
+    // **⟶ AND THE KERNEL'S OWN COMPENSATING ROLLBACK IS NOT A CONSUMER'S ACTION — `D-54`, 2026-10-28,
+    // MEASURED.** `D-42` declares it: *"A RESTART IS ONLY EVER RAISED BY A CONSUMER'S OWN `rollback` MEMBER
+    // CALL."* **THE KERNEL'S TERMINAL COMPOSITION REACHES THAT MEMBER** (`kernel-terminal.mjs`'s
+    // `composeRollback` calls `attempt.store.rollback`, the app's published member), so with the failing pass's
+    // drain now reached (`D-54` (b)) the composition's own reversal was raising a request in the pass's window
+    // — **A PHANTOM THE DRAIN THEN JUDGED**, asking a pair at the state the compensation had restored to and
+    // re-shaping a refusal no consumer wrote. **THE FLAG IS THE KERNEL'S, TAKEN AROUND ITS OWN TERMINAL ACT**
+    // (`kernel-attempt.mjs`'s `terminalComposed`), **and it is a `Symbol.for` key on the kernel record that both
+    // modules spell** — no member of any record and none of the product moves (`A117` (D6)). With it, the
+    // composition takes no watch, raises no request and judges no step: the request the pass's own bodies
+    // raised is the one the drain carries to the terminal judgement, and no other.
+    if (kernelFor(instance)[COMPENSATING] === true) return watched;
+    // **⟶ AND THE REQUEST NAMES THE ASK IT WAS RAISED UNDER, 2026-10-28 (`DEF-AL`).** A body acts INSIDE the
+    // one invocation `judgeReversal` wrapped in `ASKING`, so the pair and the address the check was actually
+    // asking are in hand at this instant. `null` where no ask stands (an action raised by a body outside a
+    // judgement — a listener's own window is the measured arm), and the arm past the budget then says so
+    // rather than naming a pair it cannot know.
+    const asking = ASKING.get(instance);
     restartRecord(instance).pending = {
       watched: watchStanding(state, instance),
+      // **AND THE MOVED SET IS MEASURED BY THE JUDGEMENT, NOT BY THE WATCH** (`judgeReversal`'s in-flight arm;
+      // `DEF-AM`): the watch is taken BEFORE the reversal runs, so what moved is not knowable here.
+      moved: null,
       reversalId: null,
       window: currentWindow(instance),
+      asked: asking === undefined ? null : asking,
     };
     return watched;
   }
@@ -1722,6 +1910,30 @@ function captureStanding(instance, address) {
   };
 }
 
+/// **THE ADDRESSES THE REVERSAL ACTUALLY MOVED, MEASURED ONCE** — the watch's capture against the standing the
+/// store holds now, with each entry's `after` beside its `before`. **A STANDING THIS REVERSAL DID NOT MOVE IS NOT
+/// A STANDING IT LEFT**, so the pair is not asked at it and cannot refuse the reversal for a state the reversal
+/// found. **IT IS THE JUDGEMENT'S SUBJECT AND THE RESTORE'S DEBT** (`judgeReversal`), and from 2026-10-28 it is
+/// also **THE WITNESS'S SUBJECT** (`DEF-AM`: the discarded request reports the addresses that MOVED, not every
+/// address the registry watches).
+function movedStanding(instance, watched) {
+  const moved = [];
+  for (let index = 0; index < watched.length; index += 1) {
+    const one = watched[index];
+    const after = standingAt(instance, one.address);
+    if (sameStanding(one.before, after) === true) continue;
+    appendOwn(moved, {
+      entry: one.entry,
+      address: one.address,
+      before: one.before,
+      beforeTier: one.beforeTier,
+      beforeTiers: one.beforeTiers,
+      after,
+    });
+  }
+  return moved;
+}
+
 /// **THE JUDGEMENT — THE TERMINAL STATE, ASKED OF EVERY PAIR THE REVERSAL TOUCHED, ONCE.** It answers
 /// `undefined` on the lawful arm (**and the caller's record then crosses unchanged**) and THROWS the surface's
 /// one plain form on the refusing arm. `reversalId` is the store's own echo of the id the reversal named
@@ -1750,6 +1962,10 @@ function captureStanding(instance, address) {
 /// actually happened: a body threw), while the treatment — restore, one log entry naming the pair, one plain
 /// form — is the violation's.
 export function judgeReversal(instance, watched, reversalId) {
+  // **A COMPENSATING ROLLBACK IS NOT JUDGED AS A STEP EITHER — `D-54` (b)**: the member is reached by the
+  // kernel's own terminal act with the flag standing, and this act must not touch a pending request or ask a
+  // pair. The consumer's own judgement is the drain's, at the pass's terminal state.
+  if (kernelFor(instance)[COMPENSATING] === true) return undefined;
   // **⟶ AND THE IN-FLIGHT ARM IS THE REQUEST'S OTHER HALF, `D-42` (2026-10-27).** `reversalWatch` answers
   // `[]` for an action taken inside an open window — no body is invoked at the reversal's instant and the step
   // is still not judged as a step — **and this frame is where the store's own echo of the id the reversal
@@ -1761,6 +1977,13 @@ export function judgeReversal(instance, watched, reversalId) {
     const record = RESTARTS.get(instance);
     if (record !== undefined && record.pending !== null && record.pending.reversalId === null) {
       record.pending.reversalId = typeof reversalId === 'string' ? reversalId : null;
+      // **⟶ AND THE WITNESS NAMES WHAT MOVED, NOT THE WHOLE WATCHED REGISTRY — `DEF-AM`, 2026-10-28.** The
+      // request the watch raised carries every enabled pair's every address as the DEBT record, which is what
+      // the restarted check must ask; the WITNESS is a different question — *"what did the refused act move?"* —
+      // and the moved set is measured here, at the reversal's own instant, by the same `before`/`after`
+      // comparison the at-rest judgement takes. **THE STORE IS READ ONCE PER WATCHED ADDRESS AND NOTHING IS
+      // INVOKED**: this is the same walk `movedStanding` performs for the at-rest arm.
+      record.pending.moved = movedStanding(instance, record.pending.watched);
     }
     return undefined;
   }
@@ -1781,34 +2004,25 @@ export function judgeReversal(instance, watched, reversalId) {
     // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
     // wider, and the same list is what a refusal has to put back — with the tier capture the watch took, so a
     // restore knows WHERE each value stood and not merely what it was.
-    const moved = [];
-    for (let index = 0; index < watched.length; index += 1) {
-      const one = watched[index];
-      // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
-      // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
-      // reversal found.
-      const after = standingAt(instance, one.address);
-      if (sameStanding(one.before, after) === true) continue;
-      appendOwn(moved, {
-        entry: one.entry,
-        address: one.address,
-        before: one.before,
-        beforeTier: one.beforeTier,
-        beforeTiers: one.beforeTiers,
-        after,
-      });
-    }
+    const moved = movedStanding(instance, watched);
     for (let index = 0; index < moved.length; index += 1) {
       const one = moved[index];
       // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
       // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
       // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).
       let outcome;
+      // **⟶ AND THE ASK IS NAMED BEFORE THE BODY RUNS, 2026-10-28 (`DEF-AL`).** A body that acts does it
+      // inside this one invocation, and the request it raises must name the pair the check was ASKING — not
+      // the watch's first address. The mark is cleared on every arm, the throwing one included, so no later
+      // act inherits an ask that has ended.
+      ASKING.set(instance, { entry: one.entry, address: one.address });
       try {
         outcome = reversalOutcome(instance, one.entry, one.address, one.after);
       } catch (thrown) {
         const undo = restoreReversal(instance, moved);
         throw reversalRefusal(one, one.after, null, reversalId, undo, thrown);
+      } finally {
+        ASKING.delete(instance);
       }
       if (outcome === true) continue;
       // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
@@ -1883,6 +2097,20 @@ export function judgeReversal(instance, watched, reversalId) {
 /// honesty `D-41` item `2` measured at `200` of `200`. **NO WRITE AND NO DELETE IS ISSUED BY THIS FUNCTION ON
 /// ANY ARM**; the store's own verb is the whole act.
 ///
+/// **⟶ AND FROM 2026-10-28 THE BASELINE THE VERDICT MEASURES IS NAMED, AND THE TWO SUCCESSES ARE TOLD APART —
+/// `DEF-AJ`, MEASURED.** **A restore that fully succeeded was reported as one that failed**: the store's act
+/// returns the store to the journal mark its commit cached at its OPENING (the 2026-10-27 ruling above), and in
+/// the restart arm the commit has already landed writes when the reversal is asked for, so **the mark's state is
+/// not the pre-reversal standing the watch captured** — every moved address then failed an `exact` test the act
+/// had already satisfied, and the sentence said *"0 of the 1 address it moved stand again"* beside a store that
+/// stood exactly where the whole commit had opened. **SO THE SENTENCE HAS TWO SUCCESS ARMS AND ONE FAILURE ARM,
+/// AND THE BASELINE OF EACH IS SAID IN IT:** a successful act with every address equal to the pre-reversal
+/// capture is *"UNDONE … (the baseline this verdict measured is the pre-reversal standing, which is the state the
+/// journal mark the commit cached at its opening holds)"*; a successful act with any address PAST the capture is
+/// *"UNDONE — as a WHOLE-COMMIT UNDO"*, and each such address is named with what stands there and what stood
+/// there immediately before the reversal; and a REFUSED mark, a CACHELESS window and a store that did not
+/// restore are *"NOT undone"*, naming every address that does not stand again (the arm unchanged).
+///
 /// **AND WHY IT CANNOT RECURSE INTO THE MEMBER.** `judgeReversal` is reached from `index.mjs`'s `rollback`
 /// member; the restore never calls that member, the addon's `rollback`, or any package member — only the store's
 /// `restoreMark` at its entry — so the judgement's ONE pass over the pairs stays one pass and `D-40`'s floor law
@@ -1936,6 +2164,16 @@ function restoreReversal(instance, moved) {
   const stateRestored = cacheless === false && (refused === null || unsaved !== null);
   let restored = 0;
   const failed = [];
+  // **⟶ AND THE VERDICT'S BASELINE IS NAMED FROM 2026-10-28 — `DEF-AJ`, MEASURED.** A restore that SUCCEEDED
+  // (`stateRestored`) has returned the store to the journal mark the commit cached at its OPENING, and that is a
+  // WHOLE-COMMIT undo: where the commit had already moved an address before the reversal was asked for, the
+  // address stands at the mark's state and NOT at the pre-reversal standing the watch captured. The old count
+  // read every such address as a FAILED restore — a restore that fully succeeded reported as one that did not —
+  // because the baseline it compared against was the pre-reversal capture and never the mark. **SO THE TWO ARE
+  // TOLD APART HERE**: `failed` is the list an UNRESTORED store is reported by (the refused mark, the cacheless
+  // window), and `wholeCommit` is the list of addresses the store's successful act returned PAST the pre-reversal
+  // standing — each named with what stands there now and what stood there immediately before the reversal.
+  const wholeCommit = [];
   // ONE VERIFICATION PER ADDRESS: two pairs over one address (or one pair naming it twice) must not be counted
   // twice, so the addresses already measured are remembered — by a local loop, never by `Array.prototype.includes`
   // on a refusal path (`contract.md §2.1`'s clause on `F8-2` and item `(2b)`'s row `54`).
@@ -1946,9 +2184,27 @@ function restoreReversal(instance, moved) {
     if (hasOwnSpelling(measured, key) === true) continue;
     appendOwn(measured, key);
     // **THE ADDRESS IS READ AGAIN, AGAINST THE CAPTURE** — the cross-tier standing and every tier with its own
-    // value — and it counts as restored ONLY where both equal what the watch took before the reversal.
+    // value — and `exact` says whether it equals what the watch took before the reversal.
     const verdict = standingVerdict(instance, one);
-    if (stateRestored && verdict.exact === true) {
+    if (stateRestored) {
+      // THE STORE'S ACT SUCCEEDED, so every measured address was returned to the mark — that is the claim the
+      // store's own answer supports, and it is counted as restored. Where the mark's state is not the
+      // pre-reversal standing, the address belongs to `wholeCommit`, which the sentence reports as the commit's
+      // own earlier work undone with the reversal rather than as a failed restore.
+      restored += 1;
+      if (verdict.exact !== true) {
+        appendOwn(wholeCommit, {
+          address: one.address,
+          before: one.before,
+          beforeTier: one.beforeTier,
+          beforeTiers: one.beforeTiers,
+          standing: verdict.value,
+          tiers: verdict.tiers,
+        });
+      }
+      continue;
+    }
+    if (verdict.exact === true) {
       restored += 1;
       continue;
     }
@@ -1963,7 +2219,7 @@ function restoreReversal(instance, moved) {
       tiers: verdict.tiers,
     });
   }
-  return { restored, total: measured.length, failed, refused, unsaved, cacheless };
+  return { restored, total: measured.length, failed, wholeCommit, refused, unsaved, cacheless };
 }
 
 /// **WHETHER A LOCAL LIST OF SPELLINGS ALREADY HOLDS ONE** — a local index loop and not `Array.prototype.includes`.
@@ -2002,10 +2258,19 @@ function standingVerdict(instance, one) {
 }
 
 /// **THE SENTENCE THE LOG CARRIES ABOUT THE UNDOING** — the refusal's own record of the compensating act, read
-/// at the ONE site that builds the log entry. **IT MAY CLAIM *"THE REVERSAL WAS UNDONE"* ONLY WHERE EVERY ADDRESS
-/// IT MOVED STANDS AGAIN EXACTLY AS IT STOOD** (`restoreReversal`'s verdict); where it cannot, **it names each
-/// address that could not be restored and says what stands there INSTEAD and what it was owed** (`D-41` item `2`:
-/// *"a message must not claim a restoration that did not happen"*). `DEF-Q`: no column prints `undefined`.
+/// at the ONE site that builds the log entry. **IT MAY CLAIM *"THE REVERSAL WAS UNDONE"* ONLY WHERE THE STORE'S
+/// OWN ACT SUCCEEDED AND EVERY ADDRESS IT MOVED STANDS AGAIN AS THE MARK SAYS** (`restoreReversal`'s verdict);
+/// where it cannot, **it names each address that could not be restored and says what stands there INSTEAD and
+/// what it was owed** (`D-41` item `2`: *"a message must not claim a restoration that did not happen"*).
+/// `DEF-Q`: no column prints `undefined`.
+///
+/// **⟶ AND A SUCCESSFUL RESTORE'S BASELINE IS NAMED, 2026-10-28 — `DEF-AJ`, MEASURED.** The act restores the
+/// journal mark the commit cached at its OPENING; where that mark stands before the reversal (the restart arm),
+/// the addresses the commit had already moved come back to the MET MARK and not to the watch's pre-reversal
+/// capture. **THE SENTENCE THEREFORE SAYS WHICH BASELINE IT MEASURED, AND A WHOLE-COMMIT UNDO IS SPOKEN AS A
+/// SUCCESS** — *"UNDONE — as a WHOLE-COMMIT UNDO"* — with each address that stands at the mark's state named
+/// beside what stood there immediately before the reversal. **ONLY THE ARMS THAT DID NOT RESTORE SAY *"NOT
+/// undone"*: the refused mark, the cacheless window, and any address left standing at what the reversal left.**
 ///
 /// **⟶ AND THE TWO ARMS THE STORE CAN ANSWER WITH ARE NAMED SEPARATELY, 2026-10-27 (THE FILE-SAVE RULING).**
 /// **A REFUSED MARK** means the store holds what it held, and the sentence says exactly that. **A FAILED SAVE
@@ -2046,9 +2311,30 @@ function undoSpelling(undo) {
     refusal = `the store REFUSED the journal mark (${JSON.stringify(typeof status === 'string' ? status : 'a refusal')}`
       + `: ${typeof said === 'string' ? said : ''}) and holds the state it held; `;
   }
-  if (undo.failed.length === 0) {
+  if (undo.failed.length === 0 && undo.wholeCommit.length === 0) {
     return `${refusal}the reversal was UNDONE: every address it moved stands again exactly as it stood before `
-      + 'the reversal — the same value at the same tier, or absent where it was absent';
+      + 'the reversal — the same value at the same tier, or absent where it was absent (the baseline this '
+      + 'verdict measured is the pre-reversal standing, which is the state the journal mark the commit cached '
+      + 'at its opening holds)';
+  }
+  // **⟶ AND A SUCCESSFUL RESTORE WHOSE MARK STANDS BEFORE THE REVERSAL IS NAMED AS WHAT IT IS — `DEF-AJ`.**
+  // The store's act succeeded (`failed` is empty), so nothing here is a failure; what differs from the watch's
+  // capture is the commit's own earlier work, which the same mark undoes. **THE SENTENCE SAYS *UNDONE* AND SAYS
+  // ITS BASELINE**, because a restore that succeeded must say so.
+  if (undo.failed.length === 0) {
+    let named = '';
+    for (let index = 0; index < undo.wholeCommit.length; index += 1) {
+      const one = undo.wholeCommit[index];
+      named += index === 0 ? '' : '; ';
+      named += `${addressSpelling(one.address)} stands ${standingDescription(one.standing, one.tiers)} where it `
+        + `stood ${capturedDescription(one)} immediately before the reversal`;
+    }
+    const movedCount = undo.total === 1 ? 'address' : 'addresses';
+    const stands = undo.restored === 1 ? 'stands' : 'stand';
+    return `${refusal}the store was restored to the journal mark its commit cached at its opening, so the `
+      + `reversal was UNDONE — as a WHOLE-COMMIT UNDO (the baseline this verdict measured is the pre-reversal `
+      + `standing): all ${undo.total} ${movedCount} it moved ${stands} where that mark leaves them, and the `
+      + `difference from the pre-reversal standing is the commit's own earlier work, undone with it — ${named}`;
   }
   let named = '';
   for (let index = 0; index < undo.failed.length; index += 1) {
@@ -2209,7 +2495,10 @@ function reversalOutcome(instance, entry, address, value) {
     // attempt stands at a reversal's judgement.
     carried.address = addressSpelling(address);
     carried.log = [];
-    const converted = bodyThrowRefusal(carried);
+    // **⟶ AND THE BODY'S OWN VALUE IS HANDED IN, 2026-10-28 (`DEF-AK`)**: `bodyThrowRefusal` carries an inner
+    // refusal beside the crossed one and names it in the crossed sentence, and the value the body threw is
+    // the only place that refusal stands.
+    const converted = bodyThrowRefusal(carried, body);
     throw converted === null ? body : converted;
   }
 }
@@ -2254,7 +2543,7 @@ function reversalSaid(outcome) {
 /// **WHERE THE THROWN VALUE IS NOT THE KERNEL'S MARKED FORM** (a body's raw throwable on a tree with no usable
 /// generator), the same rank-`18` refusal is built here — the restoration and the pair's name cross regardless
 /// of the body's own value's class, which is the difference between a compensating act and a conversion.
-function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled = false) {
+function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled = false, spentAtAsked = true) {
   const addon_ = withAddon();
   // **THE `<SEGMENT>` SLOT IS THE ADDRESS SPELLING THE KERNEL'S OWN REGISTRATION REFUSAL HANDS THE SAME
   // GENERATOR** (`kernel-registration.mjs`'s `registrationRefusal`: the segments joined by `/`, BARE — the
@@ -2278,15 +2567,48 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
         + 'constraints admit'
       : 'the reversal was refused by a constraint body that threw, the state it would leave could not be judged';
   }
+  // **⟶ AND A SPENT BUDGET IS NOT A PAIR REFUSING, IN ITS OWN WORDS — 2026-10-28, `DEF-AL`, MEASURED.** The
+  // budget's crossed `message` used to be BYTE-IDENTICAL to a genuine refusal's (the same rank-`20` member and
+  // the same generated sentence at the same subject), so a consumer reading only the message could not tell a
+  // real refusal from an exhausted budget. **The store's generated sentence still stands first (`DD-52`: one
+  // source for the code), and this arm appends the fact the code cannot carry** — the check did not settle and
+  // NO PAIR REFUSED ANYTHING; a pair body acted at every restart. A genuine refusal's message never carries
+  // this clause, which is what makes the two distinguishable.
+  if (unsettled === true) {
+    message = `${message} — this refusal is a RESTART BUDGET EXHAUSTION and NOT a constraint pair refusing a `
+      + `state: no pair refused the state the check was asking it for, a pair body acted inside the check at `
+      + `every restart, the budget of ${RESTART_LIMIT} restarts is spent and the check could not settle`;
+  }
+  // **⟶ AND AN INNER REFUSAL THE BODY THREW IS CARRIED BESIDE THE CROSSED ONE, 2026-10-28 (`DEF-AK`).** The
+  // body that threw at this judgement threw through `reversalOutcome`, whose conversion is `bodyThrowRefusal`'s
+  // — so the converted form carries the inner refusal under the same symbol, and it travels on from here.
+  const inner = thrown === null ? null : innerRefusalCarried(thrown);
+  if (inner !== null) {
+    const innerStatus = ownDataMember(inner, 'status');
+    const innerSaid = ownDataMember(inner, 'message');
+    message = `${message} — the value the constraint body threw does NOT cross as this refusal: it was ITSELF a `
+      + `refusal, ${JSON.stringify(innerStatus)} with the message ${JSON.stringify(innerSaid)}, and it crosses `
+      + `BESIDE this one under Symbol.for('provident-storeroom.inner-refusal') with its own log`;
+  }
   // **THE LOG ENTRY'S SENTENCE, AT ITS THREE ARMS** — a pair that refused the state the reversal (or the
   // in-commit action) left, a body that threw at the judgement of it, and — from `D-42` — **the restart's own
   // budget spent**. The third arm is the one the restart's exhaustion reaches and it names no refusing pair.
   let spelled;
   if (unsettled === true) {
-    spelled = `the constraint ${one.entry.id} could not be asked a state that would settle at `
-      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — the check was `
-      + `restarted ${RESTART_LIMIT} times and a pair body acted inside the check at every restart, so the `
-      + `restart budget is spent and the check does not pass — ${undoSpelling(undo)}`;
+    // **⟶ AND THE ENTRY NAMES THE PAIR THE CHECK WAS ASKING AND THE ADDRESS IT WAS ASKING AT, 2026-10-28
+    // (`DEF-AL`).** It used to name the FIRST WATCHED pair — a passing one, by id — because registration order
+    // decided it. The `spentAtAsked` arm says plainly WHEN THE BUDGET RAN OUT WITH NO ASK IN FLIGHT, so the
+    // entry never claims to name a pair it cannot know.
+    spelled = spentAtAsked === true
+      ? `the constraint ${one.entry.id} could not be asked a state that would settle at `
+        + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — this pair was being `
+        + `asked when the restart budget ran out, it did not refuse anything, a pair body acted inside the `
+        + `check at every restart, the check was restarted ${RESTART_LIMIT} times and the budget is spent, so `
+        + `the check does not pass — ${undoSpelling(undo)}`
+      : `no pair was being asked when the restart budget ran out at ${addressSpelling(one.address)}: the value `
+        + `there is ${standingSpelling(after)} — a pair body acted inside the check without an ask in flight, `
+        + `the check was restarted ${RESTART_LIMIT} times and the budget is spent, so the check does not pass `
+        + `— ${undoSpelling(undo)}`;
   } else if (thrown === null) {
     spelled = `the constraint ${one.entry.id} refused the state the reversal left at `
       + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
@@ -2331,7 +2653,18 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
   // **THE CROSSED `status` IS THE ARM'S OWN AND IS NEVER MINTED** (`DD-40`): rank `20` where a pair refused the
   // state the reversal left, rank `18` where a pair's body threw at the judgement of it (`D-41` item `4`). The
   // sentence beside it was generated for that same code — one source for each (`DD-52`).
-  return { status, message, log: refusalLog(log) };
+  const crossed = packageRefusal({ status, message, log: refusalLog(log) });
+  if (inner !== null) {
+    // THE INNER REFUSAL TRAVELS ON THE REFUSAL THE CALLER CATCHES, under the same symbol and the same
+    // non-enumerable discipline `bodyThrowRefusal` uses: the crossed form's three members are unmoved.
+    Object.defineProperty(crossed, INNER_REFUSAL, {
+      value: inner,
+      writable: false,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  return crossed;
 }
 
 /// **THE ADDRESS'S OWN `<SEGMENT>` SPELLING, JOINED BY `/` AND BARE** — the kernel's own