provident-storeroom 1.2.0 → 1.3.0

package/src/entry/delivery.mjs

@@ -6,7 +6,7 @@ import { arrayClass, classSpelling, hasLoneSurrogate, isPlainObjectValue, target
 import { encodeAddress, encodeOpId, handleWire, inDomainHandle } from './carrier.mjs';
 import { decodeSegments, spellConstraintAddress } from './frame.mjs';
 import { addressSpelling } from './kernel-foundations.mjs';
-import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
+import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, commitLogOf, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
 
 /// `PAR-JS-13`: the returned record is `{op, watched, triggered}` — fresh on every call, never a view.
 ///
@@ -555,7 +555,13 @@ export function terminalArm(state, record) {
       // receiver … A listener that is itself a store member is NOT supported"* — the package's own internal
       // paths (this one and `registerOn`'s re-install) address the store they hold, and only a CALLER's call
       // takes its receiver from `this` (`§1`).
-      carryRefusal(() => commitFile(state.receiver, answer.op.opId), [encodeOpId(answer.op.opId)]);
+      // **⟶ AND THE COMMIT'S OWN LIST GOES WITH THE CALL — `D-53`, 2026-10-28.** A save that fails is a constraint
+      // violated at the write's LAST position, so its refusal must cross carrying the COMMIT's entries (the pass's
+      // `constraint-check` entries and, by the time the caller reads it, the kernel's one `outcome` entry with the
+      // save arm's own `KC-9` in `state`). **THE LIST IS READ OFF THE RECORD THE KERNEL BUILT** (`commitLogOf(record)` — `record[COMMIT_LOG]`,
+      // a symbol key on `CommitRecord`'s own identity — no member is added, `A117` (D6)), and a record carrying none
+      // is a record this package did not build, whose failure keeps the declared `[]`.
+      carryRefusal(() => commitFile(state.receiver, answer.op.opId), [encodeOpId(answer.op.opId)], commitLogOf(record));
     } catch (saveFailure) {
       // **THE FAILURE CARRIES THE VERY THROWABLE AND ITS OWN MARK** (`docs/specs/storeroom-js/surface.md §2.11` clause 9): the kernel's catch
       // reads `SAVE_FAILED_AT_THE_TERMINAL_ARM` to tell a failed save from a body of the delivered set that

package/src/entry/kernel-attempt.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, enterCommitFrame, leaveCommitFrame } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close } from './kernel-terminal.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-3` `runAttempt(store, commit) -> AttemptReport`
@@ -37,6 +37,35 @@ const COMMIT_SCOPE = Symbol.for('provident-storeroom.commit-scope');
 /// (`§1` item 2: `K-1`–`K-5` and no sixth name).
 const RESTART_DRAIN = Symbol.for('provident-storeroom.restart-drain');
 
+/// **`D-54` (b)'s SECOND SPELLING OF THE SAME `Symbol.for` KEY** — the entry writes the restarted check's
+/// refusal onto the report under it (`constraints.mjs`'s `carryRestartRefusal`) and this module reads it back
+/// so the failing arm can answer with the very value the terminal judgement built, exactly as the passing arm
+/// reaches it through `constraintWrite`. **NEITHER SIDE IMPORTS THE OTHER** (`kernel-surface.md §1` item 1's
+/// empty import footprint), the key is invisible to `Object.keys` and to `Object.getOwnPropertyNames`
+/// (`A117` (D6)), and no kernel item is minted (`§1` item 2: `K-1`–`K-6` and no seventh name).
+const RESTART_REFUSAL = Symbol.for('provident-storeroom.restart-refusal');
+
+/// **⟶ `D-54` (b)'s COMPENSATION FLAG — the same `Symbol.for` key `constraints.mjs` spells.** The kernel's
+/// terminal act composes the attempt's rollback THROUGH THE APP'S PUBLISHED `rollback` MEMBER
+/// (`kernel-terminal.mjs`'s `composeRollback`), so that call would otherwise take a restart watch and raise a
+/// request — a phantom the failing pass's drain would then judge, asking pairs at the state the compensation
+/// had just restored to. **`D-42` declares the rule the flag keeps: *"a restart is only ever raised by a
+/// consumer's own `rollback` member call."*** The flag stands on the kernel record for the duration of the one
+/// call, is a symbol key (invisible to `Object.keys`/`Object.getOwnPropertyNames`, `A117` (D6)), and mints no
+/// kernel item (`kernel-surface.md §1` item 2).
+const COMPENSATING = Symbol.for('provident-storeroom.compensating-rollback');
+
+/// **THE KERNEL'S ONE TERMINAL ACT, TAKEN WITH ITS COMPENSATION FLAGGED** — the wrapper every terminal call in
+/// this module uses so the composition inside `terminal` is never mistaken for an action of the caller's.
+function terminalComposed(kernel, attempt, status, message) {
+  kernel[COMPENSATING] = true;
+  try {
+    terminal(kernel, attempt, status, message);
+  } finally {
+    kernel[COMPENSATING] = false;
+  }
+}
+
 /// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON AN INVOCATION'S OWN ENTRY, AND IT IS THIS PASS'S ONE USE OF THE
 /// SEAM'S SIXTH CHANNEL.** **THE RULING, THE ARCHITECT, VERBATIM: *"A constraint's repair needs to stay as part
 /// of the same commit so that it can be tracked as part of the commit process … The original way of maintaining
@@ -69,6 +98,28 @@ function repairInCommit(store, commit, run) {
   return run();
 }
 
+/// **⟶ AND THE CONSTRAINT BODY'S INVOCATION NAMES THE ATTEMPT'S COMMIT TOO — `D-53`, 2026-10-28.**
+///
+/// **THE RULING, VERBATIM: *"Constraints/Repairs should always use the same commit"*** (`strata/decisions.md` ·
+/// `D-53`). **THE INVARIANT THIS FRAME NOW KEEPS IS `D-45`'s *"it should be opening a new commit by default of
+/// entering at the surface"* READ THROUGH `D-53`'s LATER AND NARROWER ONE: a call that NAMES a commit JOINS it,
+/// and a call that names none opens one — and the kernel names the attempt's commit at EVERY invocation of
+/// caller code that belongs to the attempt, a constraint body's as well as a repair body's** (`D-46`'s device,
+/// applied to the second kind of body). **SO A CONSTRAINT NEVER OPENS A COMMIT: the check it is invoked for is
+/// already inside one (`D-44`'s scope) and this name is what makes its verb JOIN that window instead of opening
+/// a second.** **THE LOG IS THE SAME FACT SEEN FROM THE OTHER SIDE**: the entries such a verb mints are the
+/// attempt's own commit's entries, which is what `DEF-AK` measures — *"one inner refusal, two hosts"* — and what
+/// `D-53` dissolved `D-52`'s merge question with (*"the crossed report IS that list"*).
+///
+/// **A LISTENER BODY STILL NAMES NOTHING, AND THAT IS THE INVARIANT AND NOT AN OMISSION**: it is invoked by the
+/// ENTRY at the terminal arm, after the triggering commit has passed its constraints, so *"what the listener
+/// does is a NEW QUESTION and must not inherit the old verdict"* — its own commit, its own list.
+function constraintInCommit(store, commit, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run, commit);
+  return run();
+}
+
 export function runAttempt(store, commitRecord) {
   // THE SEAM, READ BEFORE ANY STATE MOVES: **a store this package did not build carries no such channel, so it
   // is not this package's store and no pass of this kernel may run against it.** The refusal is thrown BEFORE
@@ -91,12 +142,51 @@ export function runAttempt(store, commitRecord) {
   // open — a direct `K-2`/`K-3` drive, `D-44`'s window. **NO COUNT IS MINTED EITHER WAY**: the channel is
   // `openCommit`/`closeCommit` composed, and the count moves only where this call's own opening is the one that
   // took it.
+  // **⟶ AND A FAILING PASS'S TERMINAL STATE IS STILL A JUDGEMENT — `D-54` (b), 2026-10-28, MEASURED.** The bytes
+  // above reached the drain only where the pass ANSWERED A REPORT, so a pass that ended by throwing — a repair
+  // body that reversed the store had then broken the attempt's own re-run, or a delete's pass whose pair
+  // refused after its delivery's reversal — left the request its bodies raised standing, unjudged, with its
+  // effect in the store. **THE REQUEST IS CARRIED TO THE PASS'S TERMINAL JUDGEMENT**: the terminal act has run
+  // and the attempt is closed, so the state the pass left is the state the restarted check is asked at, and the
+  // drain runs here, inside the same scope, exactly as it does on the passing arm. **THE FAILING PASS'S OWN
+  // ANSWER IS NOT RE-SHAPED**: where the restarted check passes, or where the throwable is not the kernel's own
+  // (a caller body's value, a store refusal — each of which must cross as itself), the pass's throwable crosses
+  // unchanged. Only a KERNEL refusal — the pass's own terminal arm — is superseded by the refusal the restarted
+  // check built at that same terminal state, because that check's verdict is the state the pass left.
   return scope(() => {
-    const report = passInCommitScope(store, commitRecord);
+    let report;
+    try {
+      report = passInCommitScope(store, commitRecord);
+    } catch (thrown) {
+      return drainFailingPass(store, commitRecord, thrown);
+    }
     return drainRestart(store, report);
   }, commitRecord);
 }
 
+/// **THE FAILING PASS'S DRAIN — `D-54` (b)'s ONE NEW CALL SITE.**
+///
+/// **WHY THE REPORT IS READ AND NOT BUILT**: the pass's terminal act (`kernel-terminal.mjs`'s `terminal`) has
+/// already answered the attempt's ONE five-member report and placed it in the kernel's closed map before it
+/// throws, so the log the drain re-appends onto is the attempt's own list and no second report is minted
+/// (`A117` (D6): no member is added to any record). **A THROWABLE THAT STOOD BEFORE ANY TERMINAL ACT — `KC-2`,
+/// a re-entrant `KC-7`, a store refusal at `K-2` — has no closed report and no request of this pass's window
+/// either**, so it crosses unchanged and the drain is not reached: no pass ran.
+///
+/// **THE ONE PRECEDENCE RULE, STATED ONCE**: a restarted check's refusal supersedes the pass's answer only
+/// where that answer is the KERNEL's own (a `KC`-tokened refusal, `isKernelRefusal`). A constraint body's
+/// throwable is the caller's and crosses as itself (`fail-surface.md §1.1` item `5`), a store verb's refusal
+/// crosses verbatim (`§1.2` item `2`), and neither is re-shaped by a later check's verdict — the request is
+/// still judged and the store still restored by that judgement's own compensating act.
+function drainFailingPass(store, commitRecord, thrown) {
+  const closed = kernelFor(store).closed.get(commitAttemptIdOf(commitRecord));
+  if (closed === undefined) throw thrown;
+  const answered = drainRestart(store, closed);
+  const restarted = answered !== null && typeof answered === 'object' ? answered[RESTART_REFUSAL] : undefined;
+  if (restarted !== undefined && isKernelRefusal(thrown) === true) throw restarted;
+  throw thrown;
+}
+
 /// **THE DRAIN, TAKEN INSIDE THE SCOPE THE PASS JUST ENDED IN.** It hands the store **the report the pass
 /// answered with** and answers the report the kernel returns: unchanged where no request stood or the
 /// restarted check passed, and amended — `outcome` `'failed'` and the refusal's entry in the log — where the
@@ -152,7 +242,7 @@ function passInCommitScope(store, commitRecord) {
   if (terminalArm !== null) {
     // A FAILING LANDING: the arm's own terminal act, its per-op rollback composition, and the throw
     // of `fail-surface.md §1.1`'s form carrying the log.
-    terminal(kernel, attempt, terminalArm.status, terminalArm.message);
+    terminalComposed(kernel, attempt, terminalArm.status, terminalArm.message);
     // **⟶ INSTANT (b) ON THE FAILING ARM, AND IT PRECEDES THE REFUSAL** (`docs/decisions.md` · `A116`
     // (D1); `surface.md §2.4` item 9's table row (b): *"AT THE PASS'S TERMINAL ARM … after the last
     // constraint of the attempt has been evaluated and before `runAttempt` returns to the calling
@@ -239,7 +329,16 @@ function passInCommitScope(store, commitRecord) {
     // `'ok'`; where the failed save's own rollback took it the store answers `JournalOpUnknown` and the
     // composition's floor reads `KC-8` in the ONE `outcome` entry (item 5 (b); item 6 (a)).
     attempt.checkpoint = null;
-    terminal(kernel, attempt, KC.violated,
+    // **⟶ AND THE ARM'S TOKEN IS THE SET'S NINTH MEMBER, `KC-9` — `D-53`'s THIRD RULING, 2026-10-28: *"Open the
+    // token set"*.** **`D-52` MEASURED THE CONTRADICTION THIS CLOSES**: *"a constraint refusal crosses
+    // `ConstraintPassRefused` with terminal `state: 'KC-3'`; and with an in-body reversal meeting the floor,
+    // `ConstraintPassRefused` with terminal `KC-8`; a save failure crosses `FileCommitFailed` with `log: []`, and
+    // the attempt's own log reads `KC-8` — the same token a passing-pair run carries. **SO `KC-8` CROSSES AS BOTH
+    // STATUSES.**"* **THE SAVE ARM THEREFORE GETS A TOKEN OF ITS OWN**, so that a save failure and a constraint
+    // refusal cross with different statuses AND each is derivable from the log's terminal state — **and
+    // `kernel-terminal.mjs`'s precedence clause is what keeps this token through the floor**, which is otherwise
+    // `KC-8` on both arms and would put the contradiction back.
+    terminalComposed(kernel, attempt, KC.saveFailed,
       typeof saveFailure.message === 'string'
         ? saveFailure.message
         : `the attempt's own save at ${addressSpelling(attempt.address)} failed`);
@@ -257,7 +356,10 @@ function passInCommitScope(store, commitRecord) {
   // stand in one log). **AND NOTHING IS APPENDED TO THIS LOG AFTER IT**: the delivered set's bodies ran
   // before this line and reach this attempt's log by no act (`§2.7` item 6), the record this attempt's
   // report carries being the same list this line closes.
-  append(attempt, 'commit', null, attempt.ops[attempt.ops.length - 1].opId,
+  // **⟶ AND ITS ITERATION IS `{ pair: null, op }` — the `commit` entry names NO PAIR and the attempt's LAST OP**
+  // (`kernel-surface.md §2.1` item 3's `LogKind` table; `D-53`'s first ruling, which is what the iteration position
+  // carries).
+  append(attempt, 'commit', { pair: null, op: attempt.ops[attempt.ops.length - 1] },
     `every constraint registered at ${addressSpelling(attempt.address)} passed; the commit stands`);
   return closed;
 }
@@ -383,24 +485,30 @@ function evaluate(kernel, attempt, landing) {
       // THE ENTRY IS OPENED BEFORE THE BODY RUNS, so a body that reads the record's own log mid-flight
       // reads its own evaluation's entry — and it is WITHDRAWN where the body returns nothing
       // (`kernel-surface.md §2.5` item 1; `PAR-C-6`).
-      append(attempt, 'constraint-check', pair.id, op.opId, `the evaluation of ${pair.id}`);
+      // **⟶ AND IT IS NAMED BY THE ITERATION — the pair AND the op, one identity — `D-53`'s FIRST RULING**
+      // (`kernel-foundations.mjs`'s `append`; `D-52`'s rule 1: *"an entry carries the PAIR identity and the OP
+      // identity together … they are one identity"*).
+      append(attempt, 'constraint-check', { pair, op }, `the evaluation of ${pair.id}`);
       const check = attempt.log[attempt.log.length - 1];
       let outcome;
+      // **⟶ AND THE FRAME: every list the body's own verbs append to between these two lines is THIS commit's
+      // list** (`D-53`'s first invariant). The frame is pushed for exactly the invocation and popped in a
+      // `finally`, so a throwable leaves no frame standing and no later write of this commit inherits a frame it
+      // does not own.
+      enterCommitFrame(kernel, attempt.log);
       try {
-        // **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A constraint
-        // body is EXTERNALLY-SUPPLIED FUNCTION code entering the surface, **and it has no commit in hand to
-        // name** — it is handed the five-member `AttemptContext` and no commit at all (`kernel-surface.md §2.3`
-        // item 1) — so **a verb it calls OPENS ITS OWN COMMIT** rather than joining the one this pass runs in:
-        // *"It should be opening a new commit by default of entering at the surface"*. **THE NAME IS AN
-        // INVOCATION'S AND NOTHING ELSE'S**: it is set before the call and restored after it, on the throwing arm
-        // too, and the kernel's own acts of this pass name the pass's commit through `COMMIT_SCOPE` — so an
-        // ordinary write still opens ONE commit and a callback's verb is still an act of its own.
-        outcome = externalCall(attempt.store, () => pair.constraint(context));
+        // **⟶ AND THE BODY IS INVOKED WITH THE ATTEMPT'S COMMIT NAMED, 2026-10-28 (`D-53`).** `D-45` invoked it
+        // with nothing named and `D-46` narrowed that for repairs alone; **`D-53` states the invariant both halves
+        // obey: a CONSTRAINT never opens a commit and a REPAIR never opens one, while a listener's write always
+        // does.** The name is an INVOCATION's and nothing else's: it is set before the call and restored after it,
+        // on the throwing arm too, so an ordinary write still opens ONE commit and a callback's verb is still an
+        // act of its own.
+        outcome = constraintInCommit(attempt.store, attempt.record, () => pair.constraint(context));
       } catch (body) {
         // A body that threw returned nothing, so no `constraint-check` entry stands and the attempt is
         // closed (`PAR-C-6`; `NX-2`; `composition-and-states.md §2.7` item 13).
         withdraw(attempt, check);
-        terminal(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed`);
+        terminalComposed(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed`);
         // **⟶ AND THE VALUE IS MARKED HERE, BY THE FRAME THAT CAUGHT IT FROM THE BODY — `DEF-S`, 2026-10-26,
         // on the architect's ruling *"Expand the returned error set for both S/N"*.** The mark is what the
         // entry's `constraintCrossing` converts on, and an UNMARKED value still crosses as itself
@@ -409,6 +517,10 @@ function evaluate(kernel, attempt, landing) {
         // `kernel-foundations.mjs`). The throwable's own identity is unmoved at THIS layer: a kernel-level
         // caller still meets the very value the body threw.
         throw markBodyThrow(body, attempt.address, attempt.log);
+      } finally {
+        // THE FRAME GOES WITH THE INVOCATION, ON EVERY ARM (`D-53`): a frame left standing would make the NEXT
+        // write of this store join a commit it is not inside.
+        leaveCommitFrame(kernel);
       }
 
       // THE CONSTRAINT'S OWN OUTCOME — A CLOSED THREE-ARM SET (`PAR-C-5`). A value outside the three
@@ -487,7 +599,7 @@ function evaluate(kernel, attempt, landing) {
       // INSTANT IT IS APPENDED — "THE OP THE REPAIR PRODUCED WHERE IT PRODUCED ONE, ELSE THE OP IT WAS
       // INVOKED FOR" (`kernel-surface.md §2.5` item 1's `repair-run` row) — so on EVERY arm the entry
       // names THE OP THIS EVALUATION CARRIED, and only the arm that produced an op rewrites it below.
-      append(attempt, 'repair-run', pair.id, op.opId, 'the pair\'s repair was attempted');
+      append(attempt, 'repair-run', { pair, op }, 'the pair\'s repair was attempted');
       const entry = attempt.log[attempt.log.length - 1];
       let result;
       const repairContext = {
@@ -529,6 +641,9 @@ function evaluate(kernel, attempt, landing) {
         // so a repair that supplies it at `write`'s fourth position names the same commit by its own hand, and
         // the two spellings cannot disagree: **the entry's position wins where it is supplied, and this name is
         // the fallback where it is not** (`state.mjs`'s `openCommit`).
+        // **⟶ AND THE FRAME STANDS FOR THIS INVOCATION TOO (`D-53`'s first invariant): the repair's own verbs
+        // append to the attempt's list, and the frame is what makes `K-2` join rather than open.**
+        enterCommitFrame(kernel, attempt.log);
         result = repairInCommit(attempt.store, attempt.record, () => repair(repairContext));
       } catch (body) {
         // THE REPAIR-RUN ENTRY IS APPENDED BEFORE THE THROW, and the attempt's outcome entry carries
@@ -575,7 +690,7 @@ function evaluate(kernel, attempt, landing) {
         if (storeCode !== null) {
           entry.message = `the repair ${pair.id} was attempted and the store refused its own edit — the `
             + `store's answer is ${storeCode}`;
-          terminal(kernel, attempt, KC.repairFailed, entry.message);
+          terminalComposed(kernel, attempt, KC.repairFailed, entry.message);
           // **⟶ AND THE FORM THAT CROSSES TO THE CALLER IS THE KERNEL'S OWN** (`kernel-surface.md §2.3`
           // item 2 (iii): the attempt *"moves to `FAILING` with `KC-4`"*, and *"the thrown form's `status`
           // is NEVER a store member"*) — **the very form the FAILING arm above throws**, carrying the
@@ -584,8 +699,10 @@ function evaluate(kernel, attempt, landing) {
           // body's own arm and this conversion is the refused-verb's.
           refuse(attempt.throwState, attempt.throwMessage, attempt.log);
         }
-        terminal(kernel, attempt, KC.repairFailed, `the repair ${pair.id} threw; the attempt is closed`);
+        terminalComposed(kernel, attempt, KC.repairFailed, `the repair ${pair.id} threw; the attempt is closed`);
         throw body;
+      } finally {
+        leaveCommitFrame(kernel);
       }
 
       // THE REPAIR'S OWN RESULT — A CLOSED TWO-ARM SET (`PAR-C-8`), WHOSE SUCCESS ARM'S THIRD MEMBER

package/src/entry/kernel-commit.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9c`) — the commit act: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling } from './kernel-foundations.mjs';
+import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling, commitLogInFlight, COMMIT_LOG } from './kernel-foundations.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-2` `commit(store, address, tier, value) -> CommitRecord`
 // ---------------------------------------------------------------------------------------------
@@ -53,6 +53,17 @@ export function commit(store, address, tier, value) {
   // `appendOwn`), and NO ANSWER MOVES: the same segments, the same order, a FRESH array as before.
   const addressCopy = [];
   for (let i = 0; i < address.length; i += 1) appendOwn(addressCopy, address[i]);
+  // **⟶ AND THE ATTEMPT'S LOG IS THE COMMIT'S LOG — `D-53`, 2026-10-28.** A write the kernel reaches from inside
+  // an invocation it made of caller code that BELONGS TO AN ATTEMPT (a constraint body's verb at a landing, a
+  // repair body's write, a registration's body) is part of that attempt's commit, so it JOINS that commit's one
+  // list; a write reached with no such frame standing — a caller's own write, and a LISTENER BODY's write, which
+  // the entry invokes at the terminal arm — OPENS a commit and starts a fresh list, because *"the triggering
+  // commit already passed constraints"* and what the listener does now is a new question (`D-53`).
+  // **ONE LIST PER COMMIT AND NO MERGE**: the entries a nested write mints are this list's entries, their `seq`
+  // is this list's ordinal, and the crossed report of the enclosing refusal IS this list (`D-52`'s rule 2 is
+  // dissolved rather than answered — there are not two lists to reconcile).
+  const joined = commitLogInFlight(kernel);
+  const commitLog = joined === null ? [] : joined;
   const attempt = {
     ref: { id: `attempt-${kernel.attempts}` },
     store,
@@ -65,7 +76,8 @@ export function commit(store, address, tier, value) {
     // reads `triggered` as the store's returned set VERBATIM).
     write: null,
     ops: [],
-    log: [],
+    // THE COMMIT'S OWN LIST, BY REFERENCE (`D-53`): the attempt holds a reference to it and mints no second one.
+    log: commitLog,
     ran: [],
     appliedRepairs: [],
     rollback: [],
@@ -111,6 +123,18 @@ export function commit(store, address, tier, value) {
     pending: [],
   };
   attempt.record = record;
+  // **⟶ AND THE LOG TRAVELS ON THE COMMIT'S OWN RECORD, UNDER A SYMBOL KEY — `D-53`.** The record is the
+  // commit's JS identity: the fourth position names it, the entry adopts it, and the terminal arm holds it when
+  // it must tell a failed save's crossing WHICH LOG the commit's verdict stands in (`delivery.mjs`'s save arm
+  // reads it through `state.mjs`'s `commitLogOf`, which spells the same key). **NO MEMBER IS ADDED**: `Object.keys` and
+  // `Object.getOwnPropertyNames` read past a symbol (`A117` (D6)), so `CommitRecord` keeps its four members and
+  // every census of it moves by nothing.
+  Object.defineProperty(record, COMMIT_LOG, {
+    value: commitLog,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
   // **⟶ INSTANT (a)'S SEAM CALL IS WITHDRAWN, 2026-10-18** (`docs/specs/storeroom-constraints/kernel-surface.md
   // §2.1` item 2's clause of that date: *"the call of `settle(record)` THIS ITEM MAKES AT INSTANT (a) … IS
   // WITHDRAWN"*). **WITH ONE ACTOR THERE IS NOTHING TO WITHHOLD**: the record is built and complete BEFORE the

package/src/entry/kernel-foundations.mjs

@@ -38,12 +38,23 @@
 // ---------------------------------------------------------------------------------------------
 // `fail-surface.md §2` — THE KERNEL'S OWN CLOSED STATE SET, `8` MEMBERS AND NO NINTH.
 // ---------------------------------------------------------------------------------------------
+// **⟶ AND THE SET OPENS TO `9` ON 2026-10-28 — `D-53`'s THIRD RULING, THE ARCHITECT'S WORD: *"Open the token
+// set"*** (`strata/decisions.md` · `D-53`; `D-52`'s rule 3 is its measurement: **`KC-8` CROSSED AS TWO
+// STATUSES** — a constraint refusal whose composition met the floor, and a failed save — **so neither arm was
+// derivable from the log's terminal state**). **THE SENTENCE ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH
+// THIS ONE: `9` MEMBERS AND NO TENTH, ON `14` SITES.** **THE APPENDED MEMBER IS `KC-9`, THE SAVE ARM'S OWN —
+// `ConstraintSaveFailed`** — so a save failure and a constraint refusal cross with DIFFERENT statuses AND each
+// is derivable from the log's terminal state: the save arm's ONE `outcome` entry carries `KC-9` and a constraint
+// refusal's carries `KC-3`/`KC-5`/`KC-6`/`KC-8` (`KC-9`'s own row, `kernel-attempt.mjs`'s save arm, and
+// `kernel-terminal.mjs`'s precedence clause: **the FLOOR DOES NOT OVERWRITE THIS TOKEN, which is what keeps the
+// two arms apart where the save's own composition meets a floor code**).
 // `fail-surface.md §1.1` ITEM 1 (a) — THE ONE SPELLING, AND IT IS THE TOKEN: a refusal's `status` carries
-// `KC-1`…`KC-8` and NOTHING ELSE. The full names (`ConstraintViolated` …) are LABELS: they keep exactly
+// `KC-1`…`KC-9` and NOTHING ELSE. The full names (`ConstraintViolated` …) are LABELS: they keep exactly
 // one declared use — the `name` column of `§2`'s table, and a citation beside a token — and NO clause
 // spells a member's VALUE as a name. `status` and `LogEntry.state` therefore read THE SAME TOKEN STRING,
-// related by IDENTITY (`§1.1` item 1 (c)). THE CENSUS DOES NOT MOVE: `8` members (`2 + 2 + 2 + 1 + 1`)
-// on `13` sites (`1 + 4 + 4 + 3 + 1`).
+// related by IDENTITY (`§1.1` item 1 (c)). THE CENSUS MOVES BY THE RULING AND BY NOTHING ELSE:
+// `8 → 9` members (`2 + 2 + 2 + 1 + 1 + 1`) on `13 → 14` sites (`1 + 4 + 4 + 3 + 1 + 1`, the last being the
+// save arm's own, `kernel-attempt.mjs`).
 export const KC = {
   address: 'KC-1', // ConstraintAddressRefused
   arg: 'KC-2', // ConstraintArgRefused
@@ -53,9 +64,10 @@ export const KC = {
   repeat: 'KC-6', // ConstraintRepeat
   attemptOpen: 'KC-7', // ConstraintAttemptOpen
   rollbackFloor: 'KC-8', // ConstraintRollbackFloor
+  saveFailed: 'KC-9', // ConstraintSaveFailed
 };
 
-/** The eight tokens above, as the ONE list a member's own value is checked against — the kernel's own
+/** The nine tokens above, as the ONE list a member's own value is checked against — the kernel's own
  *  token is NEVER named as a store code (`fail-surface.md §1.1` item 1 (a); `§2`'s `KC-4` row). */
 export const KC_TOKENS = Object.values(KC);
 
@@ -484,6 +496,11 @@ export function kernelFor(store) {
       live: new Map(),
       closed: new Map(),
       attempts: 0,
+      // **⟶ AND THE COMMIT'S FRAME, 2026-10-28 (`D-53`)**: the stack of attempts whose commit the kernel is, at
+      // this instant, invoking caller code inside. `K-2` reads its top and joins that attempt's list; a write
+      // reached with no frame standing OPENS a commit and starts its own list. It is the instance's own, exactly
+      // as `live`/`closed` are (`D-30`), so no two stores share a frame and no module-level stack exists.
+      frames: [],
       store,
     };
     // **THE SLOT IS DEFINED AND THE RECORD IS PUBLISHED IN THE SAME ACT** (`Object.defineProperty`, exactly as
@@ -613,16 +630,91 @@ export function ownMember(value, name) {
   return descriptor.value;
 }
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ THE MESSAGE LOG BELONGS TO THE COMMIT, NOT TO THE ATTEMPT — `D-53`, 2026-10-28.**
+//
+// **THE ARCHITECT, VERBATIM: *"If it's part of the same commit, then it uses the same message log. If it opens a
+// new commit, it uses the new commit's message log. Constraints/Repairs should always use the same commit.
+// Listeners should open a new commit, because the triggering commit already passed constraints"***
+// (`strata/decisions.md` · `D-53`). **A COMMIT IS THE UNIT OF WORK AND AN ATTEMPT IS THE CONSTRAINT-JUDGED WRITE
+// INSIDE IT**, so a commit that holds several attempts — a check, its repair, the repair's own write, the re-run
+// — holds ONE list, and every one of those attempts appends to it: **`attempt.log` IS the commit's list, carried
+// by reference, and it is not a copy of anybody's.**
+//
+// **WHAT THAT DISSOLVES, SAID BECAUSE IT WAS ASKED AS A QUESTION.** `D-52`'s rule 2 asked where a nested
+// attempt's report is merged into its host's, and how a merged entry keeps *"its own attempt identity"* when
+// `seq` is *"the ordinal of the list it stands in"* and the six declared members leave no room for a seventh.
+// **THERE WAS NEVER A MERGE TO PERFORM: a constraint body's write is part of the same commit, so its entries
+// ARE this list's entries, the crossed report IS this list, no entry is renumbered and `seq` keeps its
+// declaration because there is ONE list.** `DEF-AK`'s *"one inner refusal, two hosts"* is the measurement of it.
+//
+// **THE KEY IS A `Symbol.for` SPELLING ON THE COMMIT'S OWN RECORD, AND BOTH SIDES SPELL IT** (`A117` (D6)): the
+// entry's terminal arm attaches this list to a failed save's crossing, and it holds the `CommitRecord` and
+// nothing else — so the list travels ON the record under a symbol key that `Object.keys` and
+// `Object.getOwnPropertyNames` read past, and the record keeps its FOUR declared members.
+export const COMMIT_LOG = Symbol.for('provident-storeroom.commit-log');
+
+// **THE COMMIT'S FRAME — THE ONE STRUCTURE THAT MAKES "THE SAME COMMIT" A FACT RATHER THAN A CONVENTION.** It is
+// a per-instance stack on the kernel record (`kernel.frames`, created by `kernelFor`), pushed by the kernel
+// around each invocation IT makes of caller code that belongs to an attempt — a constraint body at a landing,
+// at a registration's evaluation, at its re-run; a repair body — and popped in a `finally`.
+//
+// **`K-2` READS IT AND NOTHING ELSE DECIDES THE LOG**: a write the kernel reaches from inside such an
+// invocation JOINS the innermost frame's list; a write reached from anywhere else — a caller's own top-level
+// write, and A LISTENER BODY'S WRITE, which the ENTRY invokes at the terminal arm with no frame of this
+// kernel's standing — OPENS a commit and therefore starts a list of its own (`D-53`: *"Listeners should open a new
+// commit, because the triggering commit already passed constraints"* — what the listener saw was already
+// approved, so what it does now is a NEW QUESTION and must not inherit the old verdict).
+export function enterCommitFrame(kernel, log) {
+  appendOwn(kernel.frames, { log });
+}
+
+/** The pop, and it is a local index loop for the reason every other list surgery here is (`contract.md §2.1`'s
+ *  clause of 2026-10-24 on `F7-1`): no `Array.prototype.pop` is read on a path a caller's prototype can reach. */
+export function leaveCommitFrame(kernel) {
+  const kept = [];
+  for (let i = 0; i + 1 < kernel.frames.length; i += 1) appendOwn(kept, kernel.frames[i]);
+  kernel.frames = kept;
+}
+
+/** **THE LOG OF THE COMMIT THE KERNEL IS INSIDE, OR `null` WHERE IT IS INSIDE NONE** — the one read `K-2` takes
+ *  to decide whether this write joins a commit or opens one. */
+export function commitLogInFlight(kernel) {
+  return kernel.frames.length === 0 ? null : kernel.frames[kernel.frames.length - 1].log;
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE MESSAGE LOG (`kernel-surface.md §2.5` item 1; `PAR-C-4`). SIX MEMBERS, `seq` ASCENDING FROM
 // `1`, ONE KIND PER ENTRY: `constraint-check` | `repair-run` | `commit` | `outcome`.
-// ---------------------------------------------------------------------------------------------
-export function append(attempt, kind, id, opId, message, state) {
+//
+// **⟶ AND THE ENTRY IS NAMED BY AN ITERATION AND NOT BY TWO LOOSE IDENTITIES — 2026-10-28, `D-53`'s FIRST
+// RULING: *"Both combined to identify which constraint iteration it is on"*.** **THE ARCHITECT'S ANSWER TO
+// `D-52`'s rule 1, read with `D-53`'s own gloss: *"an entry carries the PAIR identity and the OP identity
+// together, and the PAIR identifies WHICH CONSTRAINT of that pair's evaluations is being spoken about … The two
+// columns are not alternatives — they are one identity"*.** **THE SUBJECT OF AN ENTRY IS THE ITERATION, AND AN
+// ITERATION IS A PAIR AT AN OP** — which is why no single acted-upon object could supply both, and why the old
+// `(attempt, kind, id, opId, message, state)` signature (two loose strings in two adjacent positions) could be
+// fed one value where the other belonged.
+//
+// **SO THE SIGNATURE TAKES THE ITERATION AS ONE OBJECT AT ONE POSITION, and reads its two members as its OWN
+// data members** (`D-35`'s read half: `[[GetOwnProperty]]` and never a `[[Get]]` that walks a caller's chain):
+//   * `iteration.pair` — the registry row (`{ addresses, id, constraint }`) the entry speaks about, or `null`
+//     where the kind names none (the `commit` entry names no pair, and the `outcome` entry names one only where
+//     the arm has one);
+//   * `iteration.op` — the journal op the iteration is judged at, or `null` where the kind names none.
+// **`id` IS READ OFF THE PAIR AND `opId` OFF THE OP**: a caller cannot put an id in the op's place, because
+// there is no place for one.
+export function append(attempt, kind, iteration, message, state) {
+  const held = iteration !== null && typeof iteration === 'object' ? iteration : null;
+  const pair = held === null ? undefined : ownMember(held, 'pair');
+  const op = held === null ? undefined : ownMember(held, 'op');
+  const id = pair === undefined || pair === null || typeof pair.id !== 'string' ? null : pair.id;
+  const opId = op === undefined || op === null || typeof op.opId !== 'string' ? null : op.opId;
   appendOwn(attempt.log, {
     seq: attempt.log.length + 1,
     kind,
-    id: id === undefined ? null : id,
-    opId: opId === undefined ? null : opId,
+    id,
+    opId,
     message,
     state: state === undefined ? null : state,
   });