provident-storeroom 1.2.0 → 1.4.0

package/index.d.ts

@@ -346,6 +346,33 @@ export type StoreStatus =
  *
  * `kind` is the kernel's closed four-member `LogKind` set, and `state` is the kernel's own `KC` token on the
  * one `outcome` entry and `null` on the three non-`outcome` kinds.
+ *
+ * **⟶ AND THE LIST IT STANDS IN IS THE COMMIT'S, NOT THE ATTEMPT'S — 2026-10-28 (`D-53`).** **THE ARCHITECT,
+ * VERBATIM: *"If it's part of the same commit, then it uses the same message log. If it opens a new commit, it
+ * uses the new commit's message log. Constraints/Repairs should always use the same commit. Listeners should open
+ * a new commit, because the triggering commit already passed constraints"*** (`strata/decisions.md` · `D-53`).
+ * **SO ONE COMMIT'S WORK IS ONE LIST**: a write, the constraint passes that judged it, a repair's own write and
+ * the re-run after it all append to the same array, `seq` is *"the ordinal of the list it stands in"* and it runs
+ * `1..n` CONTINUOUSLY across those attempts, and **the `log` a refusal crosses with IS that array** — which is what
+ * `DEF-AK`'s *"one inner refusal, two hosts"* measures and what `D-52`'s merge question dissolved into. **A
+ * LISTENER'S WRITE IS THE ONE THAT STARTS A FRESH LIST**, because the commit that triggered it has already passed
+ * its constraints and what the listener does is a new question.
+ *
+ * **⟶ AND WHAT `seq` IS TRUE OF IS SAID PLAINLY HERE, 2026-10-28 — `DEF-AI`, MEASURED.** **`seq` is the position
+ * of the entry in the commit's own message log; it is not the store's journal ordinal, and the two differ by
+ * design.** The kernel mints it as `log.length + 1` on the one list its commit appends to
+ * (`bindings/js/src/entry/kernel-foundations.mjs`), so a refusal's entry can carry `seq` `1` while the store's
+ * own journal counter reads `41`. **READ THE TWO AS TWO ORDINALS WITH TWO HOMES**: `JournalOp.seq` is the
+ * STORE's append ordinal and orders the store's record; this `seq` orders the COMMIT's message log and nothing
+ * else. **A consumer that compares them compares two different subjects, and no reading of this declaration
+ * says the first equals the second.**
+ *
+ * **AND `state`'S DOMAIN IS `KC-1`…`KC-9`, NOT `KC-1`…`KC-8`.** **`D-53`'s THIRD RULING — *"Open the token
+ * set"* — gives the SAVE ARM a token of its own (`KC-9`)**, so that a `file`-tier save that fails at the terminal
+ * arm and a constraint that refuses a pass cross with DIFFERENT `status` values (`FileCommitFailed` and
+ * `ConstraintPassRefused`) **each derivable from the log's terminal state** — the contradiction `D-52` measured
+ * when `KC-8` crossed as both. **NO MEMBER OF THIS DECLARATION'S `StoreStatus` MOVES**: `KC-9` rides `state` and
+ * never `status`, exactly as every `KC` token does, so the closed status set keeps its `20` members and its ranks.
  */
 export interface LogEntry {
   readonly seq: number;
@@ -372,6 +399,14 @@ export interface LogEntry {
  * failure's cause has no attempt at all** (item 4: the empty array, never an absent member and never a
  * placeholder entry) — **while every failure whose attempt exists carries that attempt's own entries, taken
  * BEFORE the attempt is disposed of** (item 10 (iii)).
+ *
+ * **⟶ AND FROM 2026-10-28 THOSE ENTRIES ARE THE COMMIT'S (`D-53`).** *"That attempt's own entries"* is read
+ * through **the one list the whole commit appends to**: an attempt holds a REFERENCE to its commit's log, so a
+ * failure crossing from ANY arm of that commit — a pass's refusal, a repair's, a `file`-tier save's at the
+ * terminal arm — carries the same array, and **a save failure's `log` is no longer `[]`**: `D-52`'s measured
+ * sentence (*"a save failure crosses as `FileCommitFailed` with `log: []`, and its verdict stands only in the
+ * attempt's log, which the crossed value does not carry"*) is the defect `D-53` closes, and the save arm's own
+ * `outcome` entry — carrying `KC-9` — is the entry that ends that list.
  */
 export interface StoreRefusal {
   readonly status: StoreStatus;
@@ -485,14 +520,49 @@ export interface DeleteRecord {
    * journal entry, so there is no op to carry: **nothing is named because nothing was destroyed.**
    */
   readonly op: JournalOp | null;
+  /**
+   * **⟶ ADDED 2026-10-29 — THE COMMIT RECORD THIS ACT MINTED, THE IDENTITY THE WHOLE COMMIT'S MACHINERY IS
+   * KEYED BY** (`D-55` item `3`; `kernel-surface.md §2.1` item `2`; `A112`).
+   *
+   * **IT IS THE SAME FOUR-MEMBER `CommitRecord` A WRITE'S `K-2` RETURNS** — `attempt` · `op` · `triggered` ·
+   * `pending` — minted by the delete's own commit act, held by the entry for adoption, and handed here on the
+   * receipt. **THE FOUR READINGS THAT FOLLOW FROM IT, EACH A MEASUREMENT THIS RELEASE PRINTED:**
+   *   * **`pending` IS THE DELETE'S RESIDUE** — the store's returned set, WHOLE at the landing, minus the
+   *     handles this delete's own pass checked off as it passed. **IT IS THE SET THE DELIVERY FIRES**: this
+   *     act delivers `pending`, not the whole `triggered` list, exactly as a write does;
+   *   * **A `file`-TIER DELETE SAVES ITS OWN OP** — the terminal arm names `op.opId` to the store's
+   *     `commit_file` on the act's PASSING arm, so the bytes describe the state the delete left (`§2.11`
+   *     clause 2, the same act a `file`-tier write gets). **THE STORE'S `delete` VERB STILL COMMITS NOTHING**
+   *     (`DD-28`; `native contract.md §7.2` item 5): the save is the ARM's, at the record's own op, and a
+   *     WHOLE-TARGET delete's op stands at no tier, so that arm serializes nothing;
+   *   * **THE LOG AND THE REPORT ARE ANSWERABLE BY REF** — `K.log(store, record.attempt)` and
+   *     `K.report(store, record.attempt)` answer the delete's own attempt after it passed, not only from a
+   *     refusal's `log` (`attempt-lifecycle.md §2.4` item 1: those items take an `AttemptRef` or its `id`);
+   *   * **AND IT CAN BE HANDED BACK** — a nested `write(address, tier, value, record)` names this commit at its
+   *     fourth position and JOINS it (`D-46`), the same object `write`'s own position accepts.
+   *
+   * **`null` IS THE `D-3` ARM** — an act that removed nothing opens no attempt, so there is no record: the member
+   * is PRESENT and says so rather than being absent (`D-21`).
+   *
+   * **AND IT IS A NON-ENUMERABLE OWN `data` PROPERTY**, the device `discarded` below declares for the same
+   * reason: `Object.keys(receipt)` and every deep-equality over the receipt read the four enumerable members
+   * they read before, while a caller reads the record **by its name** (`receipt.commit`). A spread or
+   * `Object.assign` copy does not carry it — read the member off the receipt itself.
+   */
+  readonly commit: CommitRecord | null;
   /**
    * **THE DISCARD'S WITNESS — THE REVERSALS THIS ACT'S OWN DELIVERY RAISED AND THE PACKAGE THREW AWAY**
    * (`strata/decisions.md` · `D-49`, the architect, verbatim: *"Make discard observable"*; `DEF-AH`).
    *
-   * **WHY THIS MEMBER EXISTS.** A `delete`'s listener delivery **runs no constraint pass** — there is no attempt
-   * for one to run over — so a `rollback` a listener body issues inside it raises a **restart request with no
-   * consumer**, and the fail-state is honest only if the caller learns it happened (`D-43` item 2's fail-state
-   * and both exits stand; `D-49` owes the witness and nothing else). **A listener at `window.tabs` fires for a
+   * **WHY THIS MEMBER EXISTS.** A `delete`'s listener delivery stands **after the pass's own drain** (`D-55`
+   * item `3` put the delivery after the judgement), so a `rollback` a listener body issues inside it raises a
+   * **restart request with no consumer left in this act**, and the fail-state is honest only if the caller learns
+   * it happened (`D-43` item 2's fail-state and both exits stand; `D-49` owes the witness and nothing else).
+   * **⟶ AND THE GROUND MOVED BY ONE FACT ON 2026-10-29, SAID PLAINLY:** this member's clause read *"a `delete`'s
+   * listener delivery runs no constraint pass — there is no attempt for one to run over"*, and from `D-55` item
+   * `3` the delete DOES run a pass. **WHAT IS UNMOVED IS THE READER'S FACT**: the delivery is outside that pass,
+   * its drain has already run, and a request raised here is still discarded — so the witness still has its
+   * subject and still reports it. **A listener at `window.tabs` fires for a
    * delete at `window.tabs.landingPage`** — the triggered set's membership rule is the address prefix — **and the
    * check it runs there is exactly the act the window discards**; this member is where that caller reads it.
    *
@@ -918,8 +988,9 @@ export interface StoreInstance {
    * **AND IT MOVES NO OTHER FIGURE**: the module namespace keeps its ONE name `storeCreate` (`§2.9` item 1's
    * `A127` clause, `11 → 1` ✓), the kernel's extent stays FIVE with no `K-6` proposed (`§2.4` item 9 (f),
    * item 8 — the pairs are read from the entry's OWN registry, which is keyed exactly as the kernel's is), the
-   * store's closed `17`-member set is not reached, the kernel's `KC` set stands closed at `8`, and the register
-   * keeps its `8` rows.
+   * store's closed `17`-member set is not reached, the kernel's `KC` set stands closed at `8` (**⟶ MOVED `8 → 9`
+   * on 2026-10-28 by `D-53`'s third ruling — *"Open the token set"* — the appended member being the SAVE ARM's
+   * `KC-9`; see `LogEntry`'s clause above), and the register keeps its `8` rows.
    *
    * **It is NOT a named export of this entry** (`package.md §1.3` item 3): it is reached through
    * `storeCreate`'s own product alone.

package/index.mjs

@@ -90,7 +90,7 @@ import { admittedConstraintBatch, constraintAddress, decodeBaseState, decodeJour
 import { addressSpelling } from './src/entry/kernel-foundations.mjs';
 import { FORGET_PAIR, INSTANCES, STORE_INDEX, STORE_RETIREMENT, TERMINAL_ARM, carryRefusal, closeCommit, crossTriggered, currentWindow, entryOf, homeAddressKey, installAttemptSeam, isStoreReceiver, openCommit, writeRefusal } from './src/entry/state.mjs';
 import { commitPositionRefusal, constraintOverwrittenByListen, deliver, listenerStandingAt, registerOn, terminalArm } from './src/entry/delivery.mjs';
-import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintWrite, constraintsKernel, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, withdrawStanding } from './src/entry/constraints.mjs';
+import { ARGUMENT_POSITION_FIRST, addressSetKey, carryConstraint, constraintDetached, constraintPairKey, constraintRefuse, constraintSite, constraintUncarried, constraintDelete, constraintWrite, constraintsKernel, enumerateConstraints, judgeReversal, registrationCrossing, restoreHeldPair, reversalWatch, unionAddressSets, withEmptyLog, witnessDiscardedReversal, withdrawStanding } from './src/entry/constraints.mjs';
 const require_ = createRequire(import.meta.url);
 const ADDON_PATH = join(dirOf(fileURLToPath(import.meta.url)), 'build', 'Release', 'storeroom_js_binding.node');
 
@@ -239,6 +239,14 @@ export function storeCreate(cfg) {
   // a member of the product.
   const state = {
     home: [], registry: new Map(), constraints: new Map(), leg: null, receiver: null, establishing: null,
+    // **⟶ AND THE RESIDUE'S DELIVERER, ADDED 2026-10-29 — A PRIVATE FACT ABOUT WHICH ACT OWNS A LEG'S
+    // DELIVERY.** The terminal arm performs `surface.md §2.7` item 7's delivery for a kernel-driven WRITE
+    // (`delivery.mjs`'s `terminalArm`), and it is the delete's OWN member that performs it (`D-49` declared that
+    // delivery the window whose check never ran, and this build does not move it). **IT IS A VALUE OF THE
+    // PACKAGE'S OWN STATE AND NOT A MEMBER OF ANY RECORD** (`surface.md §2.1` (e) item 1: a record, a commit
+    // and a Map are never own members of the product): `'arm'` on every path that does not say otherwise, and
+    // `'member'` for the instant a `delete` stands in, restored in the same `finally` as the leg itself.
+    legDelivery: 'arm',
   };
   // **⟶ THE RECEIVER IS THE STORE OBJECT ITSELF, AND THE INTEGER THE PACKAGE USED TO HAND ACROSS IS NOT
   // HANDED AT ALL** (`receiver-and-refusal.md §1`; `js-unwrap.md §4`). The addon resolves its store from the
@@ -410,7 +418,13 @@ export function storeCreate(cfg) {
         // (`docs/specs/storeroom-js/surface.md §2.4` item 9's adoption-machinery clause; the three architect's rulings of that date), so the store's
         // own refusal crosses back UNCHANGED AND UNCONVERTED and this frame adds nothing to it.
         // **AND THE ONE DECLARED EXCEPTION IS TAKEN HERE** — the `writeCall` arm, moved not dropped.
-        writeRefusal(refusal, fault);
+        // **⟶ AND THE COMMIT'S OWN LOG TRAVELS WITH IT — `D-53`, 2026-10-28.** The record at the method's FOURTH
+        // position is the commit's record when the kernel's own store leg made this call, and the kernel defines
+        // the commit's list on it under a symbol key; **so a store verb refusing this write tells the caller what
+        // the commit's log already carries** instead of the declared `[]`. A caller's own five-position write (or
+        // any record this package did not build) carries no such key and answers `undefined`, which is `fail`'s
+        // declared `[]` arm — unchanged on every one of those paths.
+        writeRefusal(refusal, fault, arguments.length >= 4 ? commit : undefined);
         throw refusal;
       }
       const watched = [];
@@ -478,12 +492,33 @@ export function storeCreate(cfg) {
     /// delete at `window.tabs.landingPage`, and the check it runs there is exactly the kind of act the
     /// `delete`-delivery window throws away**).
     ///
-    /// **`delete` IS THE ONE ACT WHOSE DELIVERY RUNS NO PASS AND WHOSE ANSWER SURVIVES TO TELL** (`D-43` item
-    /// 2's other window is a registration, whose answer is an opaque identity and carries nothing). So the
-    /// request a listener body raises inside THIS window — a `rollback`, stamped with this commit's identity by
-    /// `reversalWatch` — is read at the end of the delivery and reported **BESIDE** the record's four members, by
-    /// the one rule `D-49` sets: **the act still answers what it answered, no status is minted, and the witness
-    /// is not a refusal.**
+    /// **⟶ AND IT RUNS A PASS FROM 2026-10-29 — `D-55` ITEM 3, `DEF-X`. THE RULING, THE ARCHITECT, VERBATIM:
+    /// *"A delete is an editing verb and must pass constraints. This includes all of the relevant commit and
+    /// message logic."*** **THE BYTES THIS PARAGRAPH REPLACES READ *"`delete` IS THE ONE ACT WHOSE DELIVERY RUNS
+    /// NO PASS"*, AND THEY WERE TRUE OF `1.3.0` AND FALSE OF THIS TREE**: a delete opens its own commit, and
+    /// **the delete-shaped attempt `constraints.mjs`'s `constraintDelete` builds asks every pair standing at the
+    /// delete's own address **⟶ AND AT EVERY ANCESTOR OF IT, `D-56` (2026-10-28): THE PAIR'S ADDRESS BEING A PREFIX OF
+    /// THE ACT'S IS THE MEMBERSHIP TEST NOW, because the value read at a prefix CONTAINS its subtree and a change at a
+    /// descendant changes what that read returns** — against THE STATE THE DELETE LEFT**, appends the attempt's terminal entry to the
+    /// commit's one list, and — where a pair refuses — undoes the delete before it refuses (`D-55` item 5's safe
+    /// state). **NO PROBE WRITE IS LANDED TO HAVE SOMETHING TO JUDGE**: the thing judged is the delete's own
+    /// journal op, whose after-state is absence.
+    ///
+    /// **AND THE DELIVERY MOVED WITH IT — IT NOW SITS AFTER THE PASS.** At `1.3.0` the `deliver` call stood
+    /// immediately after the addon's return, so a listener fired by a delete saw a state no constraint had
+    /// approved and that a refusal was about to undo. **A LISTENER FIRED BY A DELETE NOW SEES A JUDGED STATE**,
+    /// and a refused delete delivers nothing at all. **THE POSITION IS THE WRITE'S OWN** (`surface.md §2.7` item
+    /// 6: *"the surface runs the write's TRIGGERED CONSTRAINTS FIRST, and THE OTHER LISTENERS ARE REACHED ONLY
+    /// ONCE EVERY CONSTRAINT HAS PASSED"*), and the delivery still stands inside this act's commit window, so a
+    /// listener body's own verbs open their own commits (`D-46`).
+    ///
+    /// **WHAT THE WITNESS STILL SPEAKS FOR, SAID NARROWLY.** The request a LISTENER BODY raises inside the
+    /// delivery — a `rollback`, stamped with this commit's identity by `reversalWatch` — is raised AFTER the
+    /// pass, so nothing in this act judges it: it is read at the end of the delivery and reported **BESIDE** the
+    /// record's four members, by the one rule `D-49` sets (`D-43` item 2's second window is a registration, whose
+    /// answer is an opaque identity and carries nothing). **A request a PAIR BODY raises INSIDE the pass is no
+    /// longer discarded**: it is consumed by the pass's own restart drain and judged at the state the delete
+    /// left (`D-42`; `D-54` (b)) — the third host `D-54` measured and named undeclared.
     ///
     /// **THE MEMBER IS A NON-ENUMERABLE OWN `data` PROPERTY, AND THE CHOICE IS DECLARED.** It is **visible to the
     /// caller by its name** (`record.discarded`) and declared in `index.d.ts`, while the record's **enumerable
@@ -494,9 +529,11 @@ export function storeCreate(cfg) {
     /// but is not declarable as a member of `DeleteRecord`, and `D-49` asks for the member to be declared.
     ///
     /// **THE VALUE IS `[]` WHERE NOTHING WAS DISCARDED AND ONE `{ opId, addresses }` ENTRY WHERE A REQUEST WAS**
-    /// — the id the reversal named (the store's own echo) and the addresses the discarded check would have been
-    /// asked at. **NO PASS RUNS, NO BODY IS INVOKED, NO JUDGEMENT IS TAKEN AND THE BEHAVIOUR OF THE WINDOW IS
-    /// UNMOVED**: the request is consumed (reported) and its effect still stands.
+    /// — the id the reversal named (the store's own echo) and **the addresses the refused act MOVED**, measured
+    /// at the reversal's own instant (`constraints.mjs`'s `movedStanding`), not the whole watched registry:
+    /// **a witness names what moved, because what did not move was not the act's** (`DEF-AM`, 2026-10-28).
+    /// **THE WITNESS RUNS NO PASS OF ITS OWN, INVOKES NO BODY AND TAKES NO JUDGEMENT**: the request is consumed
+    /// (reported) and its effect still stands.
     delete(address, tier) {
       // **⟶ `§4.1`: `delete` OPENS ONE.**
       const opened = openCommit(instance);
@@ -508,29 +545,78 @@ export function storeCreate(cfg) {
         // `delete`'s tier is read as a VALUE and not by an arity fold: an ABSENT position is the whole-target
         // removal, and a supplied `undefined` answers row 4's `AddressMalformed` (`crossing.md §1.3`).
         appendOwn(args, encodeTier(tier, arguments.length >= 2, false, 'first argument'));
-        // THE ENTRY IS INVOKED BY `Reflect.apply`, NOT BY A SPREAD — see `read`'s clause of 2026-10-24 above.
-        const answer = carryRefusal(() => Reflect.apply(entryOf().delete, this, args), args);
-        const receipt = {
-          address: decodeSegments(answer.address),
-          tiers: answer.tiers,
-          triggered: crossTriggered(state, answer.triggered),
-          op: answer.op === null ? null : decodeJournalOp(answer.op),
-        };
-        // `A43`: a delete FIRES its own triggered set, on the same window as a write (`docs/specs/storeroom-js/surface.md §2.7` item 2).
-        deliver(state, receipt.triggered, answer.triggeringAddress);
-        // **⟶ `D-49`: THE WITNESS, READ AFTER THE DELIVERY AND REPORTED BESIDE THE RECORD** — the delivery is
-        // the only body-invoking instant this act has, so a request standing after it is one this window raised.
-        // **ONLY A DELETE THAT OPENED ITS OWN WINDOW REPORTS**: a call that joined an enclosing commit has no
-        // window of its own to witness, and any request under that identity belongs to the act that opened it
-        // (`witnessDiscardedReversal` clears a request of the window handed in and of no other).
-        const discarded = opened === true ? witnessDiscardedReversal(instance, window) : null;
-        Object.defineProperty(receipt, 'discarded', {
-          value: discarded === null ? [] : [discarded],
-          enumerable: false,
-          writable: false,
-          configurable: true,
-        });
-        return receipt;
+        // **THE STORE'S OWN LEG, THE DELETE-SHAPED ATTEMPT AND THE PASS, IN ONE CALL** (`constraints.mjs`'s
+        // `constraintDelete`): the attempt is opened with this commit's list in hand and the address held, the
+        // thunk below is INVOKED AS ITS STORE LEG — the addon's own `delete`, crossed exactly as it always was —
+        // and the pass that follows asks every pair standing at THE DELETE'S OWN ADDRESS against the state the
+        // delete left. **NO PROBE WRITE PRECEDES THE JUDGEMENT** (`K-2`'s store leg is a `write` and this act's
+        // is not). **A REFUSAL LEAVES BY THROW, FROM INSIDE THAT CALL**, with the store already back at the
+        // state this commit opened at (`D-55` item 5) — so nothing below is reached and nothing is delivered.
+        let answer;
+        // **⟶ THE ADOPTION, 2026-10-29 — `K-2`'S OWN SEMANTICS REACHED BY THE DELETE'S OWN ROUTE.** A write's
+        // record reaches the entry at `write`'s FOURTH POSITION and that member stands it in `state.leg`, the
+        // slot the TERMINAL ARM reads for the triggering address and for the `file`-tier save's own op. **A
+        // delete's arity is the declared `delete(address, tier)`, so it has no such position** — the adoption is
+        // therefore taken HERE, at the instant the store's own verb returned and BEFORE the pass, which is the
+        // same instant and the same slot: the delete's own returned receipt stands where a write's record
+        // stands, so the terminal arm saves the DELETE's op and delivers at the DELETE's address.
+        // **AND THE ENTRY'S OWN LEG IS PUT BACK, BESIDE `closeCommit` AND IN THE SAME `finally`**: a leg left
+        // standing would be read by an ENCLOSING write's terminal arm (`state.leg` is one slot and a nested act
+        // is reached from a body — `D-53`), and the delete's record must not become the enclosing commit's.
+        const standing = state.leg;
+        const standingDelivery = state.legDelivery;
+        // THE LEG'S DELIVERY IS THIS MEMBER'S FOR THE DURATION (`D-49`'s window, unmoved): the arm saves the
+        // delete's op and delivers nothing, so the residue reaches each listener ONCE — from `deliver` below.
+        state.legDelivery = 'member';
+        try {
+          const receipt = constraintDelete(instance, address, arguments.length >= 2 ? tier : undefined, () => {
+            // THE ENTRY IS INVOKED BY `Reflect.apply`, NOT BY A SPREAD — see `read`'s clause of 2026-10-24 above.
+            answer = carryRefusal(() => Reflect.apply(entryOf().delete, this, args), args);
+            const crossed = {
+              address: decodeSegments(answer.address),
+              tiers: answer.tiers,
+              triggered: crossTriggered(state, answer.triggered),
+              op: answer.op === null ? null : decodeJournalOp(answer.op),
+            };
+            // THE ADOPTION ITSELF — one assignment, at the verb's own return.
+            state.leg = crossed;
+            return crossed;
+          });
+          // **⟶ AND THE DELIVERY NOW READS THE RECORD'S `pending` RESIDUE, 2026-10-29 — THE FOURTH MEMBER'S
+          // OWN ACT, `K-2`'s SEMANTICS REACHED BY THE DELETE'S OWN INSTANT.** The delivery's position is
+          // UNMOVED (`D-55` item `3` put it after the pass, and `D-49` declares this delivery the window whose
+          // check never ran — a request raised here is the witness's, not the drain's, and this build changes
+          // neither). **WHAT MOVES IS WHAT IT DELIVERS**: before the record existed this call handed the
+          // store's WHOLE returned set, and it now hands `record.pending` — that set MINUS the handles this
+          // delete's own pass checked off as it passed (`releasePending`), which is the write's own delivered
+          // set (`surface.md §2.7` item 7 (a)). **A `D-3` DELETE HAS NO RECORD**, so it falls back to the
+          // receipt's own `triggered` — the arm's set, empty by the store's own declaration.
+          const owed = receipt.commit === null || receipt.commit === undefined
+            ? receipt.triggered
+            : receipt.commit.pending;
+          // **THE RULE IS THE WRITE'S OWN** (`surface.md §2.7` item 6): constraints first, then the other
+          // listeners. `A43`: a delete FIRES its own triggered set, on the same window as a write.
+          deliver(state, owed, answer.triggeringAddress);
+          // **⟶ `D-49`: THE WITNESS, READ AFTER THE DELIVERY AND REPORTED BESIDE THE RECORD** — the delivery is
+          // the act's remaining body-invoking instant, so a request standing after it is one this window raised
+          // from a LISTENER BODY. **A REQUEST A PAIR BODY RAISES INSIDE THE PASS IS NOT THIS WITNESS'S**: it is
+          // consumed and judged by the pass's own restart drain (`D-42`; `D-54` (b)), and by the time this line
+          // runs it has either passed or refused the delete outright.
+          // **ONLY A DELETE THAT OPENED ITS OWN WINDOW REPORTS**: a call that joined an enclosing commit has no
+          // window of its own to witness, and any request under that identity belongs to the act that opened it
+          // (`witnessDiscardedReversal` clears a request of the window handed in and of no other).
+          const discarded = opened === true ? witnessDiscardedReversal(instance, window) : null;
+          Object.defineProperty(receipt, 'discarded', {
+            value: discarded === null ? [] : [discarded],
+            enumerable: false,
+            writable: false,
+            configurable: true,
+          });
+          return receipt;
+        } finally {
+          state.leg = standing;
+          state.legDelivery = standingDelivery;
+        }
       } finally {
         closeCommit(instance, opened);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provident-storeroom",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "U-STOREROOM-PUBLISH: the published Node ESM binding for the native Rust store of Provident-Storeroom — the entry resolves the scoped per-target platform package first, the checkout's own module-relative addon second, and answers the store's single declared absent-addon form when neither loads",
   "type": "module",
   "license": "AGPL-3.0",
@@ -35,16 +35,17 @@
     "index.mjs",
     "README.md",
     "README.guide.md",
+    "RELEASE-NOTES.md",
     "index.d.ts",
     "src/entry/",
     "src/constraint-kernel.mjs"
   ],
   "optionalDependencies": {
-    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.2.0",
-    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.2.0",
-    "@auspicion/provident-storeroom-js-darwin-x64": "1.2.0",
-    "@auspicion/provident-storeroom-js-darwin-arm64": "1.2.0",
-    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.2.0"
+    "@auspicion/provident-storeroom-js-linux-x64-gnu": "1.4.0",
+    "@auspicion/provident-storeroom-js-linux-arm64-gnu": "1.4.0",
+    "@auspicion/provident-storeroom-js-darwin-x64": "1.4.0",
+    "@auspicion/provident-storeroom-js-darwin-arm64": "1.4.0",
+    "@auspicion/provident-storeroom-js-win32-x64-msvc": "1.4.0"
   },
   "publishConfig": {
     "access": "public"