provident-storeroom 1.2.0 → 1.4.0

package/src/entry/constraints.mjs

@@ -19,7 +19,15 @@ import { currentWindow, homeAddressKey, installRestartConsumer, isStoreReceiver,
 // function the pass appends with — rather than pushed here with a member set of its own; the REFUSAL's own
 // list keeps its five members and no `seq`, because no attempt stands at the judgement that built it
 // (`D-41` item 4). Two records, two honest forms, one append.
-import { append, externalCall, kernelFor } from './kernel-foundations.mjs';
+import { append, externalCall, kernelFor, throwableForm } from './kernel-foundations.mjs';
+// **⟶ AND THE TWO KERNEL ACTS THE DELETE'S PATH OWES — `D-55` ITEM 3, 2026-10-29.** The kernel's public
+// barrel (`src/constraint-kernel.mjs`) is untouched and keeps its five names; **these are two PART modules' own
+// acts, reached here the way `append` and `kernelFor` above are** (`kernel-surface.md §1` item 1's empty import
+// footprint is the kernel's side of this edge and it is unmoved: neither module imports this file or any entry
+// module). `commitRemoval` is the commit part's remove-shaped act — a delete-shaped attempt that lands no write
+// — and `runAttempt` is the ONE pass, taken verbatim so no second pass loop is minted for a delete.
+import { commitRemoval } from './kernel-commit.mjs';
+import { runAttempt } from './kernel-attempt.mjs';
 // **⟶ AND THE CARRIERS, ADDED 2026-10-26 FOR THE REFUSAL'S OWN UNDOING (`DEF-W`'s `(a)`).** The
 // compensating act below reaches the store's own verb at its entry, with the SAME carrier forms every member
 // hands it (`carrier.mjs` is the boundary's one encoder for the three positions and imports nothing of this
@@ -72,11 +80,16 @@ export function constraintsKernel() {
   return KERNEL;
 }
 
-/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-8`, read HERE for their ONE use: to tell a
+/// `fail-surface.md §2` / `kernel-surface.md §2.2`'s `KC-1`…`KC-9`, read HERE for their ONE use: to tell a
 /// refusal the KERNEL raised from one a STORE VERB raised, so that `A120` (2) can be applied to the first
 /// and not to the second. **NO `KC` SPELLING CROSSES THIS SURFACE** (`docs/specs/storeroom-js/surface.md §2.12` item 1's read-through clause:
 /// printed here it would be a second, unowned home for the kernel's own vocabulary).
-const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8'];
+///
+/// **⟶ AND THE LIST MOVES `8 → 9` WITH THE SET ITSELF, 2026-10-28 (`D-53`: *"Open the token set"*).** The ninth
+/// member is the SAVE ARM's (`KC-9`, `kernel-foundations.mjs`'s `KC.saveFailed`); **this list must carry it or a
+/// kernel refusal carrying `KC-9` in `state` would be read here as a STORE code** and cross converted, which is the
+/// one thing this predicate exists to prevent.
+const KC_TOKENS = ['KC-1', 'KC-2', 'KC-3', 'KC-4', 'KC-5', 'KC-6', 'KC-7', 'KC-8', 'KC-9'];
 
 /// **⟶ THE PAIR'S OWN KEY IS `(id, address-set)` — `U-STOREROOM-HELD-LISTENER-IDENTITY` (`D-GP-SHLI`).**
 /// **ONE PAIR OVER N ADDRESSES IS ONE PAIR: ONE `id`, N ADDRESSES, ONE row of `constraints()`** (`P:
@@ -484,7 +497,11 @@ export function registrationCrossing(refusal) {
   // is the caller's own value and is answered as it was thrown.
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried);
+    // **`false` — THE REGISTRATION INSTANT RECORDS NOTHING, AND THE CLAUSE SAYS SO.** No attempt stands at
+    // this evaluation, so the crossing's `log` is `surface.md §2.5` item 4's declared `[]` (`DEF-S`'s own cell
+    // reads it) and no terminal entry exists to carry the throwable's form: the crossed sentence must not
+    // point at a log that does not hold it (`DEF-AK`, 2026-10-28).
+    const converted = bodyThrowRefusal(carried, refusal, false);
     if (converted !== null) throw converted;
   }
   if (isKernelBuiltRefusal(refusal) === false) throw refusal;
@@ -505,11 +522,11 @@ export function registrationCrossing(refusal) {
   // keeps its own trigger and its own sentence) — the `message` the STORE'S OWN GENERATED SENTENCE, and the
   // `log` the synthetic attempt's log where a repair was attempted and `[]` where none was. **NO `KC` TOKEN CROSSES** (`A120` (2); `docs/specs/storeroom-js/surface.md §2.12` item 3 item 2): the synthetic attempt's
   // terminal token stays in the kernel and reaches no caller.
-  throw {
+  throw packageRefusal({
     status: refusal.status,
     message: generated,
     log: refusalLog(refusal.log),
-  };
+  });
 }
 
 /// **THE DISABLED PAIR'S STANDING ELEMENT** — a function that PASSES (`kernel-surface.md §2.3` item 1:
@@ -824,6 +841,140 @@ export function constraintWrite(state, instance, address, tier, value) {
   };
 }
 
+/**
+ * **⟶ ADDED 2026-10-29 — THE DELETE'S OWN KERNEL-DRIVEN PATH: A DELETE-SHAPED ATTEMPT, A PASS, AND THE
+ * TERMINAL ENTRY. `D-55` ITEM 3, `DEF-X`, THE ARCHITECT, VERBATIM: *"A delete is an editing verb and must pass
+ * constraints. This includes all of the relevant commit and message logic."***
+ *
+ * **WHAT WAS MEASURED AT `1.3.0`, AND IT IS WHY THIS FUNCTION EXISTS.** `delete` opened its own commit window
+ * and called the addon's `delete` directly: **no `K-2`, no `K-3`, no log, no terminal entry** — so a delete
+ * consulted no constraint at all, and **the only pass shape the artefact had LANDS A WRITE FIRST** (`K-2`'s
+ * store leg called `write`, so the pass it ran judged a state the delete was not in; measured `storeAfter =
+ * {"c":2}`). **A delete therefore needed an attempt of its OWN KIND rather than a re-used `K-2`.**
+ *
+ * **THE THREE STAGES, IN THE ONE ORDER `constraintWrite` TAKES ITS OWN** (`surface.md §2.12` item 1):
+ * ```
+ *   1. the delete-shaped attempt   `kernel.commitRemoval` — the hold, the commit's log, the delete's op
+ *                                  named as the attempt's landing; NO WRITE IS LANDED
+ *   2. the store's own leg        the thunk the entry hands: the addon's `delete`, crossed by `index.mjs`
+ *   3. the pass                   `kernel.runAttempt` — every pair standing at THE DELETE'S OWN ADDRESS is
+ *                                  asked against THE STATE THE DELETE LEFT (its after-state is absence)
+ *   4. the terminal act           the attempt's ONE `outcome` entry on the refusing arm, its `commit` entry
+ *                                  on the passing arm, and on a refusal the composition that undoes the
+ *                                  delete (`D-55` item 5's safe state)
+ * ```
+ * **THE PASS IS THE WRITE'S PASS, MEMBER FOR MEMBER** — `runAttempt`, the same evaluated set, the same `D-39`
+ * registration order, the same repair and re-run arms, the same restart drain — and **the ONLY difference is the
+ * landing it judges**: a delete's journal op, whose `after` is absence, instead of a write's op whose `after` is
+ * the value it landed. **NO SECOND PASS LOOP IS MINTED**, and a repair landed under a delete's pass re-runs the
+ * same evaluation against ITS op (`D-53`: repairs use the same commit).
+ *
+ * **⟶ AND "THE SAME EVALUATED SET" IS NOW A PREFIX SET, 2026-10-29 — `D-56`, WHICH SUPERSEDES THE CLAUSE THIS
+ * PARAGRAPH PRINTED.** `RCA-8(g)` ANNOTATE-BESIDE: **the bytes that stood here read** *"the same evaluated set
+ * (the pairs whose own address IS the attempt's, `pairsAtAddress`'s exact-address rule and never the trigger set's
+ * prefix widening)"*, **and they are read THROUGH the architect's sentence**: *"A listener/constraint should fire
+ * when the descendants of its targeted address node change, because the descendants become part of the object
+ * that is read from that address"*. **SO THE DELETE'S PASS ASKS THE PAIRS AT OR ABOVE THE DELETE'S ADDRESS** —
+ * the pairs whose own address is a PREFIX of it — **and a pair at `['tabs']` is asked for a delete at
+ * `['tabs','landingPage']`** (`strata/decisions.md` · `D-56`). **THE SET IS STILL `pairsAtAddress`'s ONE
+ * FUNCTION AND STILL ONE SNAPSHOT** (`CX-12`): `D-56` moves WHICH rows are members and nothing about WHEN the
+ * list is materialised, HOW it is ordered (`HL-8` item 6: first-registration order, ancestors interleaved into
+ * that one order) or how many times a row is asked.
+ *
+ * **A REFUSAL IS THE ORDINARY REFUSAL** (`constraintCrossing` below): the surface's one plain form
+ * `{status, message, log}`, its `status` the set's rank-`20` member `ConstraintPassRefused`, and its `log` the
+ * COMMIT'S OWN LIST — `constraint-check` for the pair that refused, then the terminal `outcome` entry whose
+ * `state` is the kernel's token — each with its `seq`. **AND THE SAFE STATE IS `D-55` ITEM 5's**: the
+ * composition the terminal act runs (`composeRollback`, one floor call per address at that address's first owed
+ * op) undoes **the delete and every edit the commit made under it**, so the caller meets a store back at the
+ * state the commit opened at. Where the refusal is a RESTARTED check's (`D-42`, a reversal raised by a body
+ * inside this pass), the compensation is the reversal's own and it restores the journal mark the commit cached
+ * at ITS OPENING (`state.mjs`'s `windowMark`) — the same safe state by the other route.
+ *
+ * **`D-3`'S NO-OP ARM IS NOT AN EDIT**: where the delete removed nothing there is no journal op, so
+ * `commitRemoval` answers `null`, **no attempt is opened, no pass runs and no entry is appended** — there is no
+ * state for a pair to refuse and nothing for the safe-state rule to undo. The record crosses as it always did.
+ *
+ * **THE DELIVERY IS THE TERMINAL ARM'S FROM 2026-10-29, AND IT IS WHY THE PASS IS HANDED THE `CommitRecord`
+ * (`D-55` item 3's third demand: a listener fired by a delete sees the JUDGED state, and a refused delete
+ * delivers nothing, its commit having been undone).** `commitRemoval` now mints the record the pass's terminal
+ * arm is keyed by, and `runAttempt` reaches that arm with it (`settleArm` → the entry's `TERMINAL_ARM`), so the
+ * residue `record.pending` — the delete's returned set MINUS the handles its own pass checked off — is
+ * delivered at the arm, after the judgement, exactly as a write's is. **A REFUSED DELETE STILL DELIVERS
+ * NOTHING**: the failing arm reaches the same seam with the residue the discard emptied (`terminal`).
+ *
+ * **AND THE RECORD IS HANDED TO THE CONSUMER ON THE RECEIPT, UNDER THE `D-49` DEVICE.** `DeleteRecord` keeps
+ * its enumerable members; `commit` is a NON-ENUMERABLE own `data` property, visible by its name and declared in
+ * `index.d.ts`, exactly as `discarded` is — so the record a delete minted can be held (`receipt.commit`) and
+ * handed back (`K-4`/`K-5` take its `attempt`; a nested `write` takes the record itself at its fourth
+ * position). **`null` IS THE `D-3` ARM'S VALUE**: no attempt was opened there, so there is no record to carry.
+ */
+export function constraintDelete(instance, address, tier, remove) {
+  // THE DELETE-SHAPED ATTEMPT, OPENED AROUND THE STORE'S OWN LEG: `remove` is the addon's `delete`, already
+  // crossed by the entry, and it is invoked with the hold taken and the commit's list in hand. `null` is the
+  // `D-3` arm (nothing removed) — the receipt the thunk answered stands and nothing is judged.
+  let receipt = null;
+  let attempt;
+  try {
+    attempt = commitRemoval(instance, address, tier, () => {
+      receipt = remove();
+      return receipt;
+    });
+  } catch (refusal) {
+    // THE KERNEL'S OWN `KC-7` (a held address, before the store is reached) or the store's own refusal: the
+    // ONE crossing every kernel-driven path takes, so a nested delete at a live attempt's address answers the
+    // same rank-`20` form a write does and a store refusal crosses verbatim (`§2.5` item 10 (ii)).
+    constraintCrossing(refusal);
+  }
+  // **THE `D-3` ARM CARRIES ITS `null`** — no attempt, so no record, and the member is present rather than
+  // absent (`D-21`: a member whose act did not run says so).
+  if (attempt === null) {
+    exposeCommit(receipt, null);
+    return receipt;
+  }
+  // THE PASS, INSIDE THE COMMIT THE MEMBER OPENED (`D-44`): `runAttempt` names THE RECORD `commitRemoval`
+  // minted (`attempt.record` — the same object `K-2` hands `K-3`), so its scope JOINS — the delete's window is
+  // the pass's window, and the pairs standing at THIS address are asked against the delete's own op. **THE
+  // TERMINAL ARM IS REACHED WITH THAT RECORD AND NOTHING ELSE** (`settleArm`), so the delivery and the
+  // `file`-tier save are the record's own facts. A failing pass throws the kernel's own refusal with its log
+  // and its compensating act already taken.
+  let report;
+  try {
+    report = runAttempt(instance, attempt.record);
+  } catch (refusal) {
+    constraintCrossing(refusal);
+  }
+  // **AND THE RESTART'S REFUSAL, WHERE THE PASS ITSELF PASSED** (`D-42`; `D-54` (b)): a reversal raised by a
+  // body inside this pass is drained at the pass's terminal state, and where the restarted check refused, the
+  // refusal the report carries is the one that crosses — the delete is refused with the store already restored
+  // to the mark the commit cached at its opening. THE PASSING DELETE FINDS NO CARRIED REFUSAL AND RETURNS ITS
+  // RECEIPT UNCHANGED.
+  const restarted = report !== null && typeof report === 'object' ? report[RESTART_REFUSAL] : undefined;
+  if (restarted !== undefined) {
+    constraintCrossing(restarted);
+  }
+  exposeCommit(receipt, attempt.record);
+  return receipt;
+}
+
+/// **THE RECORD ON THE RECEIPT — A NON-ENUMERABLE OWN `data` PROPERTY, THE DEVICE `D-49` DECLARED.**
+///
+/// `Object.keys(receipt)`, every deep-equality over a receipt and every census of its ENUMERABLE members read
+/// exactly what they read before, while a caller reads the commit **by its name** (`receipt.commit`) and
+/// `index.d.ts` declares it. **IT IS A `data` PROPERTY AND NOT AN ACCESSOR**: a getter would run caller-side
+/// code on a read, which is the read half `D-35` closes everywhere else. **A RECEIPT THAT ALREADY CARRIES ONE**
+/// — the thunk answers the store's own object and this entry owns it — takes the value it was handed, and the
+/// member is defined on every arm so its presence never depends on the arm.
+function exposeCommit(receipt, record) {
+  if (receipt === null || typeof receipt !== 'object') return;
+  Object.defineProperty(receipt, 'commit', {
+    value: record === undefined ? null : record,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
+}
+
 /// **THE FAIL ARM'S CROSSING — `A120` (2): THE ENTRY CARRIES THE KERNEL'S TOKEN, THE THROW KEEPS THE
 /// STORE'S — AND THE FORM CROSSES AT THREE MEMBERS FROM 2026-10-16** (`surface.md §2.5`'s clause of that
 /// date, items 3–4 and 10 (i)–(iii); `docs/specs/storeroom-js/surface.md §2.12` item 1's mark of the same date).
@@ -1013,6 +1164,91 @@ function bodyThrowCarried(value) {
   return carried;
 }
 
+/// **⟶ ADDED 2026-10-28 — `DEF-AK`: THE INNER REFUSAL A CONSTRAINT BODY SWALLOWED AND THE CARRIER THAT PUTS
+/// IT BESIDE THE CROSSED ONE.**
+///
+/// **THE MEASUREMENT, STATED AS MEASURED.** A LISTENER body propagates an inner refusal VERBATIM — same
+/// `status`, same `message`, same two-entry `log`, same op — because no kernel frame catches a listener's body
+/// and nothing marks it. **A CONSTRAINT body making the IDENTICAL write had it REPLACED by the generated
+/// `ConstraintBodyThrew` form** (the set's rank `18`), whose single log entry was the OUTER attempt's and in
+/// which **the inner refusal's distinctive literal occurred ZERO TIMES**. **So the host you were inside decided
+/// what you were told**, and the crossed sentence's own *"a constraint body's throwable crosses as this
+/// refusal"* promised a carriage the crossing did not make.
+///
+/// **WHAT MOVES, AND WHAT DOES NOT.** `ConstraintBodyThrew` STAYS THE STATUS THAT CROSSES (the body did
+/// throw, and `DEF-S`'s ruling is unmoved); **the inner refusal — its `status`, its `message` and its own `log`
+/// — is carried BESIDE the crossed one** under this `Symbol.for` key, which both sides can spell and which
+/// `Object.keys` and `Object.getOwnPropertyNames` do not see. **The crossed `message` names the inner status,
+/// quotes the inner message and says in its own words that the value the body threw does NOT cross as the
+/// crossed refusal** — so the crossed sentence no longer claims more than it delivers, and the literal is in
+/// the text a consumer reads first. **NO MEMBER OF THE CROSSED FORM MOVES** (`{status, message, log}`, three
+/// own enumerable members), **the rank-`18` member is not renamed, no status is minted** (`DD-40`) and **an
+/// UNMARKED value still crosses as itself** (`DEF-A`'s protection, unmoved).
+const INNER_REFUSAL = Symbol.for('provident-storeroom.inner-refusal');
+
+/// **⟶ AND THE PROVENANCE MARK THAT MAKES AN INNER REFUSAL AN INNER REFUSAL, 2026-10-28 — `DEF-AK`, AND IT IS
+/// THE WHOLE REASON A SHAPE TEST CANNOT DO.**
+///
+/// **A CALLER'S BODY IS THE CALLER'S CODE, so a value it throws may carry `{status, message, log}` and be a
+/// FORGERY.** `DEF-A`'s protection — a forged refusal must never be answered as the package's own — has a
+/// second consequence here: **a forged shape must not have its text quoted back inside the package's crossed
+/// sentence either.** Measured on this pass's first cut: a constraint body throwing
+/// `{status: 'ValueNotAdmitted', message: 'the caller forged this refusal', log: []}` had the forged text
+/// printed in the crossed message as though the package had found a refusal there, which is the same
+/// laundering `DEF-A` closed one layer out.
+///
+/// **SO AN INNER REFUSAL IS IDENTIFIED BY A MARK THIS PACKAGE SETS ON THE FORMS IT BUILDS**, spelled here
+/// under a `Symbol.for` key exactly as `KERNEL_REFUSAL` and `CONSTRAINT_BODY_THREW_ENTRY` are, and never by a
+/// member a caller can spell. The kernel's own refusals (`isKernelBuiltRefusal`) count too: both are the
+/// store's forms, and a caller's value is neither.
+const PACKAGE_REFUSAL = Symbol.for('provident-storeroom.package-refusal');
+
+/// **THE ONE PLACE THIS FILE'S OWN REFUSAL FORMS ARE MARKED** — the three crossing arms and the judgement's
+/// own form reach it, so a refusal built here and then caught from a body is recognisable as the store's and
+/// never as a caller's. **NO MEMBER MOVES**: the mark is a symbol-keyed, non-enumerable own data member, so
+/// `Object.keys` still reads `["log","message","status"]` and no census of the three sees it.
+function packageRefusal(form) {
+  Object.defineProperty(form, PACKAGE_REFUSAL, {
+    value: true,
+    writable: false,
+    enumerable: false,
+    configurable: true,
+  });
+  return form;
+}
+
+/// **THE INNER REFUSAL A BODY'S THROWABLE CARRIES, OR `null`** — asked of the value the frame that CAUGHT it
+/// from the body has in hand, so the identity question is already answered: this reads the value's OWN data
+/// members (`D-35`'s read half) and answers the value only where it carries the surface's own refusal form —
+/// a non-empty `status` string, a `message` string and a `log` array. **A BODY THAT THREW SOMETHING ELSE IS
+/// `null`** (a `TypeError`, a string, a bare object with no `log`), and the crossed sentence then stands as
+/// the generated one: the throwable is not a refusal, there is no inner refusal to carry beside the crossed
+/// one, and nothing is invented for it.
+function innerRefusalThrown(thrown) {
+  if (thrown === null || typeof thrown !== 'object') return null;
+  // **THE PROVENANCE TEST COMES FIRST AND IS THE MARK, NOT THE SHAPE** (`PACKAGE_REFUSAL` above): a refusal
+  // this package built, or one the kernel built, is the store's; anything else — including a caller's forged
+  // three-member object — is not, and the crossed sentence never quotes a value it cannot attribute.
+  if (thrown[PACKAGE_REFUSAL] !== true && isKernelBuiltRefusal(thrown) === false) return null;
+  const status = ownDataMember(thrown, 'status');
+  const message = ownDataMember(thrown, 'message');
+  const log = ownDataMember(thrown, 'log');
+  if (typeof status !== 'string' || status.length === 0) return null;
+  if (typeof message !== 'string' || message.length === 0) return null;
+  if (Array.isArray(log) === false) return null;
+  return thrown;
+}
+
+/// **THE INNER REFUSAL A CROSSED REFUSAL CARRIES BESIDE IT, OR `null`** — the mark's read half, taken off
+/// the value this package BUILT and never off a caller's shape: the fact travels under the `Symbol.for` key
+/// above, so no member a caller can spell decides it.
+function innerRefusalCarried(value) {
+  if (value === null || typeof value !== 'object') return null;
+  const carried = value[INNER_REFUSAL];
+  if (carried === null || typeof carried !== 'object') return null;
+  return carried;
+}
+
 /// **THE ONE FAILURE FORM FOR A BODY'S THROW** — `{status, message, log}`, `§2.5` items 3–4's form at this arm
 /// too: the `status` the set's rank-`18` member, the `message` the STORE'S OWN GENERATED sentence (reached
 /// through the generator this package already holds, `addon_.errorMessage` — `DD-52` forbids a second source),
@@ -1021,17 +1257,59 @@ function bodyThrowCarried(value) {
 /// **A TREE THAT CARRIES NO USABLE GENERATOR ANSWERS `null`**, and both crossings then re-throw the marked
 /// value AS ITSELF — the same safe direction `registrationCrossing` takes for a kernel refusal, and no
 /// sentence is authored here.
-function bodyThrowRefusal(carried) {
+function bodyThrowRefusal(carried, thrown, recorded) {
   const addon_ = withAddon();
   if (typeof addon_.errorMessage !== 'function') return null;
   const subject = typeof carried.address === 'string' ? carried.address : '';
-  const generated = addon_.errorMessage(BODY_THREW_STATUS, subject);
+  let generated = addon_.errorMessage(BODY_THREW_STATUS, subject);
   if (typeof generated !== 'string' || generated.length === 0) return null;
-  return {
+  // **⟶ `DEF-AK`, 2026-10-28: THE INNER REFUSAL IS CARRIED BESIDE THE CROSSED ONE AND THE SENTENCE SAYS SO.**
+  // The value this frame was handed is the very value the body threw (the frame above caught it and marked it),
+  // so the inner refusal is in hand: where it carries the surface's own form, the generated sentence — whose
+  // own words are *"a constraint body's throwable crosses as this refusal"* — is followed by the clause that
+  // stops it claiming more than the crossing delivers, and the value itself travels under `INNER_REFUSAL`.
+  const inner = innerRefusalThrown(thrown);
+  if (inner !== null) {
+    const innerStatus = ownDataMember(inner, 'status');
+    const innerSaid = ownDataMember(inner, 'message');
+    generated = `${generated} — the value the constraint body threw does NOT cross as this refusal: it was `
+      + `ITSELF a refusal, ${JSON.stringify(innerStatus)} with the message ${JSON.stringify(innerSaid)}, and it `
+      + `crosses BESIDE this one under Symbol.for('provident-storeroom.inner-refusal') with its own log — the `
+      + `generated sentence above names the CODE for a body that threw and not the value the body threw`;
+  } else {
+    // **⟶ AND THE PLAIN THROWABLE'S SENTENCE STOPS CLAIMING A CROSSING IT DOES NOT MAKE — `D-55` ITEM 1,
+    // `DEF-AK`, 2026-10-28.** The generated sentence's own bytes are *"a constraint body's throwable crosses
+    // as this refusal"*, and the throwable DOES NOT: it is not carried, its members are not merged and its
+    // identity is not handed on. **WHAT DOES CROSS IS ITS MESSAGE, IN THE COMMIT'S LOG** — the terminal arm of
+    // the attempt that caught it put the form the value took (the string's own text, the object's own
+    // `message` member, or the kind of value it was) in the ONE entry the arm appends. **`recorded` IS THAT
+    // FACT, SAID BY THE CROSSING THAT CALLED THIS FRAME** (`constraintCrossing` reads the arm that records it;
+    // `registrationCrossing` and the judgement do not), **so no arm points at a `log` that does not carry it**:
+    // where the arm records nothing the clause says so and names the declared `[]` (`surface.md §2.5` item 4).
+    const where = recorded === true
+      ? `the form the throwable took stands in the \`outcome\` entry of this refusal's \`log\`, which is where `
+        + `a throwable's own message crosses`
+      : `no entry of this failure's \`log\` records it — \`log\` is the declared empty list where no attempt `
+        + `stands (surface.md §2.5 item 4) — so nothing of the value crosses`;
+    generated = `${generated} — the value the constraint body threw does NOT cross as this refusal: ${where}`;
+  }
+  const crossed = {
     status: BODY_THREW_STATUS,
     message: generated,
     log: refusalLog(carried.log),
   };
+  packageRefusal(crossed);
+  if (inner !== null) {
+    // A SYMBOL-KEYED, NON-ENUMERABLE OWN MEMBER: `Object.keys` and `Object.getOwnPropertyNames` read the
+    // crossed form's three members exactly as they did, and the inner refusal is reachable by its name.
+    Object.defineProperty(crossed, INNER_REFUSAL, {
+      value: inner,
+      writable: false,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  return crossed;
 }
 
 function constraintCrossing(refusal) {
@@ -1043,7 +1321,10 @@ function constraintCrossing(refusal) {
   // `{status, message}` AND NO MARK STILL CROSSES AS ITSELF, BELOW.**
   const carried = bodyThrowCarried(refusal);
   if (carried !== null) {
-    const converted = bodyThrowRefusal(carried);
+    // **`true` — THIS IS THE LANDING'S OWN CROSSING, AND ITS TERMINAL ARM RECORDS THE THROWABLE'S FORM**
+    // (`kernel-attempt.mjs`'s `evaluate`: the attempt closes with ONE `outcome` entry whose sentence carries
+    // `throwableForm(body)`), so the crossed sentence may point at it and `DEF-AK`'s log entry exists.
+    const converted = bodyThrowRefusal(carried, refusal, true);
     if (converted !== null) throw converted;
   }
   const isObject = refusal !== null && typeof refusal === 'object';
@@ -1076,11 +1357,11 @@ function constraintCrossing(refusal) {
     }
   }
   if (typeof status !== 'string' || kernelToken === false) {
-    throw {
+    throw packageRefusal({
       status: refusal.status,
       message: refusal.message,
       log: refusalLog(log),
-    };
+    });
   }
   // **THE KERNEL'S OWN `KC` REFUSAL.** Its `{status, message, log}` is the KERNEL'S OWN three-member form
   // (`docs/specs/storeroom-constraints/fail-surface.md §1.1`), and **⟶ FROM 2026-10-26 IT CROSSES WITH THE
@@ -1089,13 +1370,13 @@ function constraintCrossing(refusal) {
   // **THE TOKEN STILL DOES NOT ENTER `status`** — it is on the attempt's own `outcome` entry's `state` in the
   // `log`, which is `D-38`'s reading — **AND `FileCommitFailed` IS NOW THE SAVE'S CODE ALONE, minted by save
   // failures only.** The message is the kernel's own, UNMOVED; the `log` is the attempt's, VERBATIM.
-  throw {
+  throw packageRefusal({
     status: CONSTRAINT_PASS_REFUSED,
     message: typeof refusal.message === 'string'
       ? refusal.message
       : 'the write was refused by a constraint of this attempt',
     log: refusalLog(log),
-  };
+  });
 }
 
 
@@ -1336,10 +1617,16 @@ function reversalAtRest(instance) {
 /// the store object, so a second store is a second record, the record dies with its store, and **NO MEMBER IS
 /// ADDED TO THE PRODUCT, TO A RECORD OR TO THE KERNEL** (`A117` (D6)'s four-member guardrail is untouched).
 ///
-/// **`pending` IS THE REQUEST** — `{ watched, reversalId, window }`:
+/// **`pending` IS THE REQUEST** — `{ watched, reversalId, window, asked }`:
 ///   * `watched` the check's own beginning captured BEFORE the action ran (`reversalWatch`);
 ///   * `reversalId` the store's own echo of the id the reversal named (attached by `judgeReversal` in the same
 ///     frame, one line after the action);
+///   * **⟶ `asked` THE PAIR THAT WAS BEING ASKED WHEN THE ACTION WAS RAISED, OR `null`, ADDED 2026-10-28 —
+///     `DEF-AL`, THE MISATTRIBUTION.** The budget's refusal used to name `watched[0]` — the FIRST WATCHED
+///     ADDRESS — so **registration order decided the accusation**: measured, the pair it named had answered
+///     `true` on every ask it received. **The ask in flight is known at the instant the request is raised**
+///     (`ASKING` below, set by `judgeReversal` around the one body invocation and read here), so the request
+///     records the pair and the address the check was actually at, and the arm past the budget names THOSE.
 ///   * **⟶ `window` the IDENTITY OF THE COMMIT THE ACTION WAS TAKEN IN** (`state.mjs`'s `currentWindow`, minted
 ///     with the opening and answered by every joining call), **ADDED 2026-10-27 — AND IT IS WHAT RETIRES THE
 ///     COUNTING FRAME.** `D-42`'s own sentence is *"a request belongs to the act that raised it"*; while the
@@ -1352,6 +1639,43 @@ function reversalAtRest(instance) {
 ///     by the enclosing pass's) still belongs to that window and is still consumed.
 const RESTARTS = new WeakMap();
 
+/// **⟶ `D-54` (b)'s ONE FLAG, SPELLED HERE AND IN `kernel-attempt.mjs`** — the `Symbol.for` key the kernel's
+/// terminal act stands on its own record while its compensating composition runs, so `reversalWatch` can tell
+/// the package's own undo from a consumer's `rollback` member call (`D-42`: *"a restart is only ever raised by a
+/// consumer's own `rollback` member call"*). **A SYMBOL ON THE KERNEL RECORD AND NOT A MEMBER OF THE PRODUCT OR
+/// OF ANY RECORD** (`A117` (D6)), no kernel item is minted (`kernel-surface.md §1` item 2), and the flag stands
+/// only for the duration of that one call.
+const COMPENSATING = Symbol.for('provident-storeroom.compensating-rollback');
+
+/// **⟶ THE ASK IN FLIGHT, 2026-10-28 — `DEF-AL`'s ONE NEW READ, AND IT IS A `WeakMap` FOR THE SAME REASONS
+/// THE RESTART RECORD IS ONE** (`D-30`; `D-46`): keyed by the store, so a second store is a second record, the
+/// record dies with its store, and no member is added to the product, to a record or to the kernel.
+///
+/// **WHAT IT CARRIES, AND WHY IT CANNOT LIVE ON THE REQUEST ALONE.** `{ entry, address }` — the pair
+/// `judgeReversal` is asking and the address it is asking at — set immediately BEFORE the one body invocation
+/// and cleared immediately after it, on every arm including the throwing one. **A body that raises a reversal
+/// does it INSIDE that invocation**, so `reversalWatch`'s in-flight arm reads the entry standing here and
+/// stamps it on the request it raises. Without it the arm past the budget has nothing to name but the watch's
+/// first address, which is a fact about registration order and not about the check.
+const ASKING = new WeakMap();
+
+/// **⟶ THE VALUE A BODY THREW, CARRIED FROM THE FRAME THAT CAUGHT IT TO THE ENTRY THAT MUST PRINT IT, ADDED
+/// 2026-10-28 — `D-55` ITEM 1, `DEF-AK`, MEASURED.**
+///
+/// **THE WINDOW IT CLOSES.** A pair body that throws at a reversal's judgement is caught by `reversalOutcome`,
+/// which converts it to the surface's rank-`18` form; `judgeReversal` then catches that and builds the refusal
+/// whose ONE log entry names the throwing pair. **NOTHING OF THE THROWABLE REACHED ANY RECORD**: the crossed
+/// sentence said *"a constraint body's throwable crosses as this refusal"* and the log carried only the pair's
+/// name. **D-55's clarification (the architect, verbatim: *"Include a thrown message in the message log.
+/// Obviously."*) makes the message a log entry's own business**, and no attempt log stands at this judgement —
+/// so the form travels here, from the catch frame to `reversalRefusal`'s entry sentence.
+///
+/// **A `WeakMap` KEYED BY THE CONVERTED FORM AND NOTHING ELSE** (`D-30`'s device, `D-46`): the form's three
+/// declared members are unmoved, no symbol is spelled on a value a caller holds, and the record dies with the
+/// value. **A TREE WITH NO USABLE GENERATOR IS NOT CONVERTED**, so its raw value reaches `reversalRefusal` and
+/// that frame spells the form itself (`throwableForm`) — the map answers nothing and nothing is invented.
+const THROWN_FORM = new WeakMap();
+
 /// **HOW MANY RESTARTS ONE PASS'S COMMIT SCOPE MAY TAKE** — the bound `drainRestartRequests` spends. Three is
 /// the declared figure: two fewer than any arm of this package's own batteries drives, and enough that a lawful
 /// in-commit action's single restart never meets it.
@@ -1428,29 +1752,38 @@ export function drainRestartRequests(instance, report) {
   for (;;) {
     const request = record.pending;
     if (request === null) return report;
-    // **A REQUEST BELONGS TO THE ACT THAT RAISED IT — MEASURED** (`D-42` item `3`'s closing sentence): a request
-    // standing from a window this pass did not open has no consumer HERE, and it is dropped rather than
-    // attributed to an unrelated check. **IT DIES WITH ITS WINDOW, AND THAT IS THE DECLARED FAIL-STATE**
-    // (`D-43` item `2`: the file reloads or the client regenerates the store). **TWO WINDOWS HOLD A COMMIT AND
-    // RUN NO PASS, AND THEY ARE NAMED RATHER THAN LEFT TO A MEASUREMENT**: a `delete`'s listener delivery (a
-    // delete consults no constraint, `D-1-bis`) and a REGISTRATION's own evaluation (`addConstraint`/
-    // `register`, whose body is asked at an instant no attempt of the pass kind stands at — `context.attempt`
-    // is `null` there). A request raised by a body inside either one has no consumer and dies here.
-    if (request.window !== window) {
-      record.pending = null;
-      return report;
-    }
+    // **A PASS DOES NOT CONSUME A REQUEST IT DID NOT RAISE — `D-54`, 2026-10-28, MEASURED.**
+    // `RCA-8(g)` ANNOTATE-BESIDE: the bytes that stood here read *"a request standing from a window this pass
+    // did not open has no consumer HERE, and it is dropped"*, and **the drop was a CONSUMPTION**: a nested
+    // pass — a listener body's own write, a reentrant write inside an open commit — cleared a request the
+    // ENCLOSING window had raised, so the enclosing pass's own drain found nothing to judge and the reversal's
+    // effect stood. **THE REQUEST IS THEREFORE LEFT WHERE IT STANDS**: this pass asks nothing at it and takes
+    // nothing from it, and the consumer that matches its window is still free to reach it. **A REQUEST NOBODY
+    // CONSUMES STILL DIES WITH ITS WINDOW** (`D-42` item `3`; `D-43` item `2`): windows are never reused, so a
+    // stale stamp can be consumed by no later pass, it is overwritten by the next action's own request, and the
+    // two declared passless windows have their own answers — the `delete`'s witness reports (and clears) its
+    // own, the registration's is read by no surface. **A MISMATCHED REQUEST IS NOT CONSUMED, AND THAT IS THE
+    // WHOLE OF HALF (a).**
+    if (request.window !== window) return report;
     record.pending = null;
     if (request.watched.length === 0) continue;
     rounds += 1;
     if (rounds > RESTART_LIMIT) {
       // THE CHECK DID NOT SETTLE: THE SAME FORM, THE SAME STATUS, THE SAME COMPENSATION (`D-41` item `4`'s
       // direction), and the log entry says the budget was spent rather than that a pair refused.
-      const one = request.watched[0];
+      //
+      // **⟶ AND IT NAMES THE ADDRESS THE BUDGET WAS SPENT AT AND THE PAIR THAT WAS BEING ASKED, 2026-10-28 —
+      // `DEF-AL`, MEASURED.** This arm named `request.watched[0]` — the FIRST WATCHED ADDRESS — so
+      // REGISTRATION ORDER DECIDED THE ACCUSATION, and the pair it named had answered `true` on every ask it
+      // received: `log[0]` named the true cause while naming a passing pair by id. **THE REQUEST'S OWN
+      // `asked` IS THAT PAIR** (`reversalWatch`'s clause above), and it is the one the check was at when it
+      // ran out. Where no ask stood, the entry says so and names no pair it cannot know.
+      const asked = request.asked !== null && request.asked !== undefined ? request.asked : null;
+      const one = asked === null ? request.watched[0] : { entry: asked.entry, address: asked.address };
       const after = standingAt(instance, one.address);
       const undo = restoreReversal(instance, request.watched);
       return carryRestartRefusal(report,
-        reversalRefusal(one, after, null, request.reversalId, undo, null, true));
+        reversalRefusal(one, after, null, request.reversalId, undo, null, true, asked !== null));
     }
     try {
       judgeReversal(instance, request.watched, request.reversalId);
@@ -1476,11 +1809,13 @@ export function drainRestartRequests(instance, report) {
 /// **WHAT THIS FUNCTION IS, AND WHAT IT IS NOT.**
 ///   * **IT RUNS NO PASS, NO BODY AND NO JUDGEMENT.** It reads the instance's own restart record — the record
 ///     `reversalWatch` raised the request in — and answers a fresh copy of the two facts a consumer needs: the
-///     id the reversal named (`reversalId`, the store's own echo) and the addresses the discarded check would
-///     have been asked at (`the watch's addresses`, deduplicated by spelling and copied segment for segment).
-///     **THE STORE IS NOT TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS
-///     MOVED** — the `D-49` bar: *"a witness is not a refusal: the act still answers what it answered, the
-///     discard is reported beside it, and nothing new is minted in the closed status set."*
+///     id the reversal named (`reversalId`, the store's own echo) and **the addresses the refused act MOVED**
+///     (`request.moved`, measured by `judgeReversal` at the reversal's own instant and deduplicated by spelling,
+///     segment for segment). **THE WATCH'S FULL ADDRESS LIST IS THE DEBT RECORD AND IS NOT THE WITNESS**: naming
+///     every watched address would say nothing about what the act did (`DEF-AM`, 2026-10-28). **THE STORE IS NOT
+///     TOUCHED, NO CODE IS MINTED, NO LOG ENTRY IS APPENDED AND NO MEMBER OF ANY RECORD IS MOVED** — the `D-49`
+///     bar: *"a witness is not a refusal: the act still answers what it answered, the discard is reported beside
+///     it, and nothing new is minted in the closed status set."*
 ///   * **IT CONSUMES THE REQUEST IT REPORTS.** A request whose window is the caller's has no consumer that could
 ///     ever run it (the window's act ran no pass, and a later pass compares the identity and drops it — the
 ///     drain's own arm), so clearing the slot here moves no behaviour: it is the same clearing the drain would
@@ -1507,10 +1842,16 @@ export function witnessDiscardedReversal(instance, window) {
   // 2026-10-27): a request standing from another window is that window's and is left where it stands.
   if (request.window !== window) return null;
   record.pending = null;
+  // **⟶ AND THE ADDRESSES ARE THE ONES THE REFUSED ACT MOVED, NOT THE WHOLE WATCHED REGISTRY — `DEF-AM`,
+  // 2026-10-28.** The request's `watched` is the DEBT record and names every enabled pair's every address;
+  // `moved` is what `judgeReversal` measured at the reversal's own instant (`movedStanding`) and is the only
+  // answer a witness owes. **A WITNESS THAT NAMES EVERY ADDRESS THE REGISTRY WATCHES NAME NOTHING**: the
+  // discarded check's subject is the state the reversal changed.
+  const subject = Array.isArray(request.moved) ? request.moved : [];
   const addresses = [];
   const spellings = [];
-  for (let index = 0; index < request.watched.length; index += 1) {
-    const address = request.watched[index].address;
+  for (let index = 0; index < subject.length; index += 1) {
+    const address = subject[index].address;
     const spelling = homeAddressKey(address);
     let seen = false;
     for (let known = 0; known < spellings.length; known += 1) {
@@ -1531,6 +1872,17 @@ export function witnessDiscardedReversal(instance, window) {
   }
   // THE STORE'S OWN ECHO OF THE ID THE REVERSAL NAMED — `null` where the reversal's call answered no id (the
   // request stands and the act's answer did not reach the echo, which is a real arm a caller can see).
+  //
+  // **⟶ AND AN ENTRY IS NEVER SHIPPED WITH AN EMPTY ADDRESS LIST — `D-55` ITEM 2, `DEF-AH`, 2026-10-28.**
+  // The architect, verbatim: *"A witness address of [] corresponds to the register itself. This is not a legal
+  // response for any other watched address."* **SO `[]` IS THE REGISTER (THE ROOT) AND IS AN ADDRESS, NEVER A
+  // LIST**: a request whose reversal moved NOTHING has no discard to report — there is no legal response to
+  // give it — so **the entry is ABSENT (`null`) rather than empty**, and the caller reads `discarded: []`
+  // because nothing was discarded *observably*. **AND THE ROOT STAYS DISTINGUISHABLE**: an address that IS
+  // `[]` is one element of `addresses` — `[[]]` — which is length `1` and therefore survives this test; the
+  // distinction the ruling draws is between an ADDRESS of `[]` and a LIST of `[]`, and this is the one line
+  // where it is measured.
+  if (addresses.length === 0) return null;
   return {
     opId: typeof request.reversalId === 'string' ? request.reversalId : null,
     addresses,
@@ -1574,7 +1926,14 @@ function carryRestartRefusal(report, refusal) {
   const log = { log: report.log };
   for (let index = 0; index < carried.length; index += 1) {
     const entry = carried[index];
-    append(log, entry.kind, entry.id, entry.opId, entry.message, entry.state);
+    // **⟶ AND THE REPLAY NAMES THE ITERATION AS THE ENTRY IT IS CARRYING NAMES IT — `D-53`'s first ruling.** This is
+    // the ONE `append` site whose two identities come from a CARRIED ENTRY and not from an acted-upon pair and op
+    // (`D-52` counted it as rule 1's fourth kind), so the iteration is rebuilt from the two identities the entry
+    // itself carries: **the pair stands by its `id`, and the op by the `opId` the judgement's reversal answered —
+    // and the pair's own row is not in hand here, which is why the identity alone is spelled.** Nothing is
+    // renumbered and nothing is re-authored: the entry minted here is the report's own, by the report's own
+    // ordinal, and its two identity columns read exactly what the entry it carries read.
+    append(log, entry.kind, { pair: { id: entry.id }, op: { opId: entry.opId } }, entry.message, entry.state);
   }
   Object.defineProperty(report, RESTART_REFUSAL, {
     value: refusal,
@@ -1639,10 +1998,74 @@ export function reversalWatch(state, instance) {
   // runs in, so *"a request belongs to the act that raised it"* (`D-42` item `3`) is MEASURED at this line and
   // checked at that one, and the `CHECK_DEPTH` frame that once approximated it is deleted with its clears.
   if (reversalAtRest(instance) === false) {
-    restartRecord(instance).pending = {
-      watched: watchStanding(state, instance),
+    // **⟶ AND THE KERNEL'S OWN COMPENSATING ROLLBACK IS NOT A CONSUMER'S ACTION — `D-54`, 2026-10-28,
+    // MEASURED.** `D-42` declares it: *"A RESTART IS ONLY EVER RAISED BY A CONSUMER'S OWN `rollback` MEMBER
+    // CALL."* **THE KERNEL'S TERMINAL COMPOSITION REACHES THAT MEMBER** (`kernel-terminal.mjs`'s
+    // `composeRollback` calls `attempt.store.rollback`, the app's published member), so with the failing pass's
+    // drain now reached (`D-54` (b)) the composition's own reversal was raising a request in the pass's window
+    // — **A PHANTOM THE DRAIN THEN JUDGED**, asking a pair at the state the compensation had restored to and
+    // re-shaping a refusal no consumer wrote. **THE FLAG IS THE KERNEL'S, TAKEN AROUND ITS OWN TERMINAL ACT**
+    // (`kernel-attempt.mjs`'s `terminalComposed`), **and it is a `Symbol.for` key on the kernel record that both
+    // modules spell** — no member of any record and none of the product moves (`A117` (D6)). With it, the
+    // composition takes no watch, raises no request and judges no step: the request the pass's own bodies
+    // raised is the one the drain carries to the terminal judgement, and no other.
+    if (kernelFor(instance)[COMPENSATING] === true) return watched;
+    // **⟶ AND THE REQUEST NAMES THE ASK IT WAS RAISED UNDER, 2026-10-28 (`DEF-AL`).** A body acts INSIDE the
+    // one invocation `judgeReversal` wrapped in `ASKING`, so the pair and the address the check was actually
+    // asking are in hand at this instant. `null` where no ask stands (an action raised by a body outside a
+    // judgement — a listener's own window is the measured arm), and the arm past the budget then says so
+    // rather than naming a pair it cannot know.
+    const asking = ASKING.get(instance);
+    const window = currentWindow(instance);
+    // **⟶ AND A SECOND RAISE IN THE SAME COMMIT MERGES INTO THE REQUEST RATHER THAN REPLACING IT — `D-55`
+    // ITEM 6's SECOND HALF, `DEF-AP`, 2026-10-28, MEASURED.** **WHAT WAS MEASURED:** two listeners each
+    // reversing inside ONE commit — two raises in one window — left only the LAST raise judged; the earlier
+    // listener's own violation was asked **zero** times, registration order decided which raise was lost, and
+    // when the survivor's judgement passed the write returned normally **with the violation standing**. **THE
+    // ROW'S OWN ESCAPE — declare that an overwritten raise may leave a violation unjudged — IS UNAVAILABLE**,
+    // because `DEF-AN`'s safe-state rule is the promise: a refused edit undoes the WHOLE commit.
+    // **SO THE DRAIN JUDGES THE STATE THE COMMIT STANDS AT, NOT THE REQUEST THAT HAPPENED TO SURVIVE**: the
+    // request's captures are merged to the EARLIEST reading of each address — the state the commit opened at —
+    // so `movedStanding` at the drain sees every address the WHOLE commit moved, whichever raise named it.
+    // **THE WALK'S ORDER AND MEMBERSHIP STAY THE REGISTRY'S** (`watchStanding`'s `D-39` order, re-read now):
+    // an address this raise's walk carries takes the earlier capture where one exists, and an address the
+    // earlier watch carried but the registry no longer does leaves the debt record (it is not the check's
+    // subject now). **THE LATEST RAISE KEEPS ITS OWN ASK AND ITS `moved` IS RE-MEASURED**; the `reversalId`
+    // stays the first echo it recorded (`judgeReversal`'s in-flight arm sets it once), so the entry a refusal
+    // names is never re-spelled.
+    const next = watchStanding(state, instance);
+    const record = restartRecord(instance);
+    const prior = record.pending;
+    if (prior !== null && prior.window === window) {
+      const merged = [];
+      for (let index = 0; index < next.length; index += 1) {
+        const one = next[index];
+        const spelling = homeAddressKey(one.address);
+        let earlier = null;
+        for (let known = 0; known < prior.watched.length; known += 1) {
+          if (homeAddressKey(prior.watched[known].address) === spelling) {
+            earlier = prior.watched[known];
+            break;
+          }
+        }
+        appendOwn(merged, earlier === null ? one : earlier);
+      }
+      prior.watched = merged;
+      // THE MOVED SET IS RE-MEASURED AGAINST THE MERGED CAPTURES (`judgeReversal`'s in-flight arm does it at
+      // the reversal's own instant, one frame below this call) — a set measured against the later watch would
+      // hide the earlier raise's movement, which is the defect this merge closes.
+      prior.moved = null;
+      prior.asked = asking === undefined ? prior.asked : asking;
+      return watched;
+    }
+    record.pending = {
+      watched: next,
+      // **AND THE MOVED SET IS MEASURED BY THE JUDGEMENT, NOT BY THE WATCH** (`judgeReversal`'s in-flight arm;
+      // `DEF-AM`): the watch is taken BEFORE the reversal runs, so what moved is not knowable here.
+      moved: null,
       reversalId: null,
-      window: currentWindow(instance),
+      window,
+      asked: asking === undefined ? null : asking,
     };
     return watched;
   }
@@ -1722,6 +2145,30 @@ function captureStanding(instance, address) {
   };
 }
 
+/// **THE ADDRESSES THE REVERSAL ACTUALLY MOVED, MEASURED ONCE** — the watch's capture against the standing the
+/// store holds now, with each entry's `after` beside its `before`. **A STANDING THIS REVERSAL DID NOT MOVE IS NOT
+/// A STANDING IT LEFT**, so the pair is not asked at it and cannot refuse the reversal for a state the reversal
+/// found. **IT IS THE JUDGEMENT'S SUBJECT AND THE RESTORE'S DEBT** (`judgeReversal`), and from 2026-10-28 it is
+/// also **THE WITNESS'S SUBJECT** (`DEF-AM`: the discarded request reports the addresses that MOVED, not every
+/// address the registry watches).
+function movedStanding(instance, watched) {
+  const moved = [];
+  for (let index = 0; index < watched.length; index += 1) {
+    const one = watched[index];
+    const after = standingAt(instance, one.address);
+    if (sameStanding(one.before, after) === true) continue;
+    appendOwn(moved, {
+      entry: one.entry,
+      address: one.address,
+      before: one.before,
+      beforeTier: one.beforeTier,
+      beforeTiers: one.beforeTiers,
+      after,
+    });
+  }
+  return moved;
+}
+
 /// **THE JUDGEMENT — THE TERMINAL STATE, ASKED OF EVERY PAIR THE REVERSAL TOUCHED, ONCE.** It answers
 /// `undefined` on the lawful arm (**and the caller's record then crosses unchanged**) and THROWS the surface's
 /// one plain form on the refusing arm. `reversalId` is the store's own echo of the id the reversal named
@@ -1750,6 +2197,10 @@ function captureStanding(instance, address) {
 /// actually happened: a body threw), while the treatment — restore, one log entry naming the pair, one plain
 /// form — is the violation's.
 export function judgeReversal(instance, watched, reversalId) {
+  // **A COMPENSATING ROLLBACK IS NOT JUDGED AS A STEP EITHER — `D-54` (b)**: the member is reached by the
+  // kernel's own terminal act with the flag standing, and this act must not touch a pending request or ask a
+  // pair. The consumer's own judgement is the drain's, at the pass's terminal state.
+  if (kernelFor(instance)[COMPENSATING] === true) return undefined;
   // **⟶ AND THE IN-FLIGHT ARM IS THE REQUEST'S OTHER HALF, `D-42` (2026-10-27).** `reversalWatch` answers
   // `[]` for an action taken inside an open window — no body is invoked at the reversal's instant and the step
   // is still not judged as a step — **and this frame is where the store's own echo of the id the reversal
@@ -1761,6 +2212,13 @@ export function judgeReversal(instance, watched, reversalId) {
     const record = RESTARTS.get(instance);
     if (record !== undefined && record.pending !== null && record.pending.reversalId === null) {
       record.pending.reversalId = typeof reversalId === 'string' ? reversalId : null;
+      // **⟶ AND THE WITNESS NAMES WHAT MOVED, NOT THE WHOLE WATCHED REGISTRY — `DEF-AM`, 2026-10-28.** The
+      // request the watch raised carries every enabled pair's every address as the DEBT record, which is what
+      // the restarted check must ask; the WITNESS is a different question — *"what did the refused act move?"* —
+      // and the moved set is measured here, at the reversal's own instant, by the same `before`/`after`
+      // comparison the at-rest judgement takes. **THE STORE IS READ ONCE PER WATCHED ADDRESS AND NOTHING IS
+      // INVOKED**: this is the same walk `movedStanding` performs for the at-rest arm.
+      record.pending.moved = movedStanding(instance, record.pending.watched);
     }
     return undefined;
   }
@@ -1781,34 +2239,25 @@ export function judgeReversal(instance, watched, reversalId) {
     // THE MOVED SET IS TAKEN FIRST, ONCE: the judgement's subject is the CHANGE the reversal made and nothing
     // wider, and the same list is what a refusal has to put back — with the tier capture the watch took, so a
     // restore knows WHERE each value stood and not merely what it was.
-    const moved = [];
-    for (let index = 0; index < watched.length; index += 1) {
-      const one = watched[index];
-      // THE ADDRESS IS READ AGAIN, AT THE STATE THE REVERSAL LEFT. **A STANDING THIS REVERSAL DID NOT MOVE IS
-      // NOT A STANDING IT LEFT**, so the pair is not asked and cannot refuse the reversal for a state the
-      // reversal found.
-      const after = standingAt(instance, one.address);
-      if (sameStanding(one.before, after) === true) continue;
-      appendOwn(moved, {
-        entry: one.entry,
-        address: one.address,
-        before: one.before,
-        beforeTier: one.beforeTier,
-        beforeTiers: one.beforeTiers,
-        after,
-      });
-    }
+    const moved = movedStanding(instance, watched);
     for (let index = 0; index < moved.length; index += 1) {
       const one = moved[index];
       // **THE BODY'S THROW IS THE JUDGEMENT'S OWN CATCH AND NOT A PROPAGATING VALUE** — `reversalOutcome` converts
       // a body's throwable to the surface's rank-`18` form and re-throws anything unmarked as itself, and BOTH
       // arrive here: the reversal has run, so a judgement that cannot complete restores and refuses (below).
       let outcome;
+      // **⟶ AND THE ASK IS NAMED BEFORE THE BODY RUNS, 2026-10-28 (`DEF-AL`).** A body that acts does it
+      // inside this one invocation, and the request it raises must name the pair the check was ASKING — not
+      // the watch's first address. The mark is cleared on every arm, the throwing one included, so no later
+      // act inherits an ask that has ended.
+      ASKING.set(instance, { entry: one.entry, address: one.address });
       try {
         outcome = reversalOutcome(instance, one.entry, one.address, one.after);
       } catch (thrown) {
         const undo = restoreReversal(instance, moved);
         throw reversalRefusal(one, one.after, null, reversalId, undo, thrown);
+      } finally {
+        ASKING.delete(instance);
       }
       if (outcome === true) continue;
       // **THE FIRST VIOLATING PAIR DECIDES AND THE SECOND IS NOT EVALUATED** (`attempt-lifecycle.md §2.4` item 5
@@ -1883,6 +2332,20 @@ export function judgeReversal(instance, watched, reversalId) {
 /// honesty `D-41` item `2` measured at `200` of `200`. **NO WRITE AND NO DELETE IS ISSUED BY THIS FUNCTION ON
 /// ANY ARM**; the store's own verb is the whole act.
 ///
+/// **⟶ AND FROM 2026-10-28 THE BASELINE THE VERDICT MEASURES IS NAMED, AND THE TWO SUCCESSES ARE TOLD APART —
+/// `DEF-AJ`, MEASURED.** **A restore that fully succeeded was reported as one that failed**: the store's act
+/// returns the store to the journal mark its commit cached at its OPENING (the 2026-10-27 ruling above), and in
+/// the restart arm the commit has already landed writes when the reversal is asked for, so **the mark's state is
+/// not the pre-reversal standing the watch captured** — every moved address then failed an `exact` test the act
+/// had already satisfied, and the sentence said *"0 of the 1 address it moved stand again"* beside a store that
+/// stood exactly where the whole commit had opened. **SO THE SENTENCE HAS TWO SUCCESS ARMS AND ONE FAILURE ARM,
+/// AND THE BASELINE OF EACH IS SAID IN IT:** a successful act with every address equal to the pre-reversal
+/// capture is *"UNDONE … (the baseline this verdict measured is the pre-reversal standing, which is the state the
+/// journal mark the commit cached at its opening holds)"*; a successful act with any address PAST the capture is
+/// *"UNDONE — as a WHOLE-COMMIT UNDO"*, and each such address is named with what stands there and what stood
+/// there immediately before the reversal; and a REFUSED mark, a CACHELESS window and a store that did not
+/// restore are *"NOT undone"*, naming every address that does not stand again (the arm unchanged).
+///
 /// **AND WHY IT CANNOT RECURSE INTO THE MEMBER.** `judgeReversal` is reached from `index.mjs`'s `rollback`
 /// member; the restore never calls that member, the addon's `rollback`, or any package member — only the store's
 /// `restoreMark` at its entry — so the judgement's ONE pass over the pairs stays one pass and `D-40`'s floor law
@@ -1936,6 +2399,16 @@ function restoreReversal(instance, moved) {
   const stateRestored = cacheless === false && (refused === null || unsaved !== null);
   let restored = 0;
   const failed = [];
+  // **⟶ AND THE VERDICT'S BASELINE IS NAMED FROM 2026-10-28 — `DEF-AJ`, MEASURED.** A restore that SUCCEEDED
+  // (`stateRestored`) has returned the store to the journal mark the commit cached at its OPENING, and that is a
+  // WHOLE-COMMIT undo: where the commit had already moved an address before the reversal was asked for, the
+  // address stands at the mark's state and NOT at the pre-reversal standing the watch captured. The old count
+  // read every such address as a FAILED restore — a restore that fully succeeded reported as one that did not —
+  // because the baseline it compared against was the pre-reversal capture and never the mark. **SO THE TWO ARE
+  // TOLD APART HERE**: `failed` is the list an UNRESTORED store is reported by (the refused mark, the cacheless
+  // window), and `wholeCommit` is the list of addresses the store's successful act returned PAST the pre-reversal
+  // standing — each named with what stands there now and what stood there immediately before the reversal.
+  const wholeCommit = [];
   // ONE VERIFICATION PER ADDRESS: two pairs over one address (or one pair naming it twice) must not be counted
   // twice, so the addresses already measured are remembered — by a local loop, never by `Array.prototype.includes`
   // on a refusal path (`contract.md §2.1`'s clause on `F8-2` and item `(2b)`'s row `54`).
@@ -1946,9 +2419,27 @@ function restoreReversal(instance, moved) {
     if (hasOwnSpelling(measured, key) === true) continue;
     appendOwn(measured, key);
     // **THE ADDRESS IS READ AGAIN, AGAINST THE CAPTURE** — the cross-tier standing and every tier with its own
-    // value — and it counts as restored ONLY where both equal what the watch took before the reversal.
+    // value — and `exact` says whether it equals what the watch took before the reversal.
     const verdict = standingVerdict(instance, one);
-    if (stateRestored && verdict.exact === true) {
+    if (stateRestored) {
+      // THE STORE'S ACT SUCCEEDED, so every measured address was returned to the mark — that is the claim the
+      // store's own answer supports, and it is counted as restored. Where the mark's state is not the
+      // pre-reversal standing, the address belongs to `wholeCommit`, which the sentence reports as the commit's
+      // own earlier work undone with the reversal rather than as a failed restore.
+      restored += 1;
+      if (verdict.exact !== true) {
+        appendOwn(wholeCommit, {
+          address: one.address,
+          before: one.before,
+          beforeTier: one.beforeTier,
+          beforeTiers: one.beforeTiers,
+          standing: verdict.value,
+          tiers: verdict.tiers,
+        });
+      }
+      continue;
+    }
+    if (verdict.exact === true) {
       restored += 1;
       continue;
     }
@@ -1963,7 +2454,7 @@ function restoreReversal(instance, moved) {
       tiers: verdict.tiers,
     });
   }
-  return { restored, total: measured.length, failed, refused, unsaved, cacheless };
+  return { restored, total: measured.length, failed, wholeCommit, refused, unsaved, cacheless };
 }
 
 /// **WHETHER A LOCAL LIST OF SPELLINGS ALREADY HOLDS ONE** — a local index loop and not `Array.prototype.includes`.
@@ -2002,10 +2493,19 @@ function standingVerdict(instance, one) {
 }
 
 /// **THE SENTENCE THE LOG CARRIES ABOUT THE UNDOING** — the refusal's own record of the compensating act, read
-/// at the ONE site that builds the log entry. **IT MAY CLAIM *"THE REVERSAL WAS UNDONE"* ONLY WHERE EVERY ADDRESS
-/// IT MOVED STANDS AGAIN EXACTLY AS IT STOOD** (`restoreReversal`'s verdict); where it cannot, **it names each
-/// address that could not be restored and says what stands there INSTEAD and what it was owed** (`D-41` item `2`:
-/// *"a message must not claim a restoration that did not happen"*). `DEF-Q`: no column prints `undefined`.
+/// at the ONE site that builds the log entry. **IT MAY CLAIM *"THE REVERSAL WAS UNDONE"* ONLY WHERE THE STORE'S
+/// OWN ACT SUCCEEDED AND EVERY ADDRESS IT MOVED STANDS AGAIN AS THE MARK SAYS** (`restoreReversal`'s verdict);
+/// where it cannot, **it names each address that could not be restored and says what stands there INSTEAD and
+/// what it was owed** (`D-41` item `2`: *"a message must not claim a restoration that did not happen"*).
+/// `DEF-Q`: no column prints `undefined`.
+///
+/// **⟶ AND A SUCCESSFUL RESTORE'S BASELINE IS NAMED, 2026-10-28 — `DEF-AJ`, MEASURED.** The act restores the
+/// journal mark the commit cached at its OPENING; where that mark stands before the reversal (the restart arm),
+/// the addresses the commit had already moved come back to the MET MARK and not to the watch's pre-reversal
+/// capture. **THE SENTENCE THEREFORE SAYS WHICH BASELINE IT MEASURED, AND A WHOLE-COMMIT UNDO IS SPOKEN AS A
+/// SUCCESS** — *"UNDONE — as a WHOLE-COMMIT UNDO"* — with each address that stands at the mark's state named
+/// beside what stood there immediately before the reversal. **ONLY THE ARMS THAT DID NOT RESTORE SAY *"NOT
+/// undone"*: the refused mark, the cacheless window, and any address left standing at what the reversal left.**
 ///
 /// **⟶ AND THE TWO ARMS THE STORE CAN ANSWER WITH ARE NAMED SEPARATELY, 2026-10-27 (THE FILE-SAVE RULING).**
 /// **A REFUSED MARK** means the store holds what it held, and the sentence says exactly that. **A FAILED SAVE
@@ -2046,9 +2546,30 @@ function undoSpelling(undo) {
     refusal = `the store REFUSED the journal mark (${JSON.stringify(typeof status === 'string' ? status : 'a refusal')}`
       + `: ${typeof said === 'string' ? said : ''}) and holds the state it held; `;
   }
-  if (undo.failed.length === 0) {
+  if (undo.failed.length === 0 && undo.wholeCommit.length === 0) {
     return `${refusal}the reversal was UNDONE: every address it moved stands again exactly as it stood before `
-      + 'the reversal — the same value at the same tier, or absent where it was absent';
+      + 'the reversal — the same value at the same tier, or absent where it was absent (the baseline this '
+      + 'verdict measured is the pre-reversal standing, which is the state the journal mark the commit cached '
+      + 'at its opening holds)';
+  }
+  // **⟶ AND A SUCCESSFUL RESTORE WHOSE MARK STANDS BEFORE THE REVERSAL IS NAMED AS WHAT IT IS — `DEF-AJ`.**
+  // The store's act succeeded (`failed` is empty), so nothing here is a failure; what differs from the watch's
+  // capture is the commit's own earlier work, which the same mark undoes. **THE SENTENCE SAYS *UNDONE* AND SAYS
+  // ITS BASELINE**, because a restore that succeeded must say so.
+  if (undo.failed.length === 0) {
+    let named = '';
+    for (let index = 0; index < undo.wholeCommit.length; index += 1) {
+      const one = undo.wholeCommit[index];
+      named += index === 0 ? '' : '; ';
+      named += `${addressSpelling(one.address)} stands ${standingDescription(one.standing, one.tiers)} where it `
+        + `stood ${capturedDescription(one)} immediately before the reversal`;
+    }
+    const movedCount = undo.total === 1 ? 'address' : 'addresses';
+    const stands = undo.restored === 1 ? 'stands' : 'stand';
+    return `${refusal}the store was restored to the journal mark its commit cached at its opening, so the `
+      + `reversal was UNDONE — as a WHOLE-COMMIT UNDO (the baseline this verdict measured is the pre-reversal `
+      + `standing): all ${undo.total} ${movedCount} it moved ${stands} where that mark leaves them, and the `
+      + `difference from the pre-reversal standing is the commit's own earlier work, undone with it — ${named}`;
   }
   let named = '';
   for (let index = 0; index < undo.failed.length; index += 1) {
@@ -2209,7 +2730,21 @@ function reversalOutcome(instance, entry, address, value) {
     // attempt stands at a reversal's judgement.
     carried.address = addressSpelling(address);
     carried.log = [];
-    const converted = bodyThrowRefusal(carried);
+    // **⟶ AND THE BODY'S OWN VALUE IS HANDED IN, 2026-10-28 (`DEF-AK`)**: `bodyThrowRefusal` carries an inner
+    // refusal beside the crossed one and names it in the crossed sentence, and the value the body threw is
+    // the only place that refusal stands.
+    //
+    // **⟶ AND ITS FORM IS TAKEN HERE, 2026-10-28 — `D-55` ITEM 1, `DEF-AK`.** No attempt stands at a reversal's
+    // judgement, so there is no terminal entry for the kernel to record it in: **the judgement's own refusal
+    // list is the log this failure crosses with**, and its ONE entry carries the form the body threw
+    // (`reversalRefusal` reads it off this `WeakMap`). **A `WeakMap` AND NOT A MEMBER**: the converted form's
+    // three members are unmoved and nothing is added to any record (`A117` (D6)).
+    const form = throwableForm(body);
+    // **`false` — NO ATTEMPT LOG STANDS AT A JUDGEMENT, AND THIS FRAME'S OWN LIST KEEPS ITS ONE ENTRY**: the
+    // form the body threw is carried through `THROWN_FORM` and printed in that entry's sentence by
+    // `reversalRefusal`, so the crossed sentence points at the `log` it actually carries (`DEF-AK`).
+    const converted = bodyThrowRefusal(carried, body, false);
+    if (converted !== null && typeof converted === 'object') THROWN_FORM.set(converted, form);
     throw converted === null ? body : converted;
   }
 }
@@ -2254,7 +2789,7 @@ function reversalSaid(outcome) {
 /// **WHERE THE THROWN VALUE IS NOT THE KERNEL'S MARKED FORM** (a body's raw throwable on a tree with no usable
 /// generator), the same rank-`18` refusal is built here — the restoration and the pair's name cross regardless
 /// of the body's own value's class, which is the difference between a compensating act and a conversion.
-function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled = false) {
+function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled = false, spentAtAsked = true) {
   const addon_ = withAddon();
   // **THE `<SEGMENT>` SLOT IS THE ADDRESS SPELLING THE KERNEL'S OWN REGISTRATION REFUSAL HANDS THE SAME
   // GENERATOR** (`kernel-registration.mjs`'s `registrationRefusal`: the segments joined by `/`, BARE — the
@@ -2278,23 +2813,66 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
         + 'constraints admit'
       : 'the reversal was refused by a constraint body that threw, the state it would leave could not be judged';
   }
+  // **⟶ AND A SPENT BUDGET IS NOT A PAIR REFUSING, IN ITS OWN WORDS — 2026-10-28, `DEF-AL`, MEASURED.** The
+  // budget's crossed `message` used to be BYTE-IDENTICAL to a genuine refusal's (the same rank-`20` member and
+  // the same generated sentence at the same subject), so a consumer reading only the message could not tell a
+  // real refusal from an exhausted budget. **The store's generated sentence still stands first (`DD-52`: one
+  // source for the code), and this arm appends the fact the code cannot carry** — the check did not settle and
+  // NO PAIR REFUSED ANYTHING; a pair body acted at every restart. A genuine refusal's message never carries
+  // this clause, which is what makes the two distinguishable.
+  if (unsettled === true) {
+    message = `${message} — this refusal is a RESTART BUDGET EXHAUSTION and NOT a constraint pair refusing a `
+      + `state: no pair refused the state the check was asking it for, a pair body acted inside the check at `
+      + `every restart, the budget of ${RESTART_LIMIT} restarts is spent and the check could not settle`;
+  }
+  // **⟶ AND AN INNER REFUSAL THE BODY THREW IS CARRIED BESIDE THE CROSSED ONE, 2026-10-28 (`DEF-AK`).** The
+  // body that threw at this judgement threw through `reversalOutcome`, whose conversion is `bodyThrowRefusal`'s
+  // — so the converted form carries the inner refusal under the same symbol, and it travels on from here.
+  const inner = thrown === null ? null : innerRefusalCarried(thrown);
+  if (inner !== null) {
+    const innerStatus = ownDataMember(inner, 'status');
+    const innerSaid = ownDataMember(inner, 'message');
+    message = `${message} — the value the constraint body threw does NOT cross as this refusal: it was ITSELF a `
+      + `refusal, ${JSON.stringify(innerStatus)} with the message ${JSON.stringify(innerSaid)}, and it crosses `
+      + `BESIDE this one under Symbol.for('provident-storeroom.inner-refusal') with its own log`;
+  }
   // **THE LOG ENTRY'S SENTENCE, AT ITS THREE ARMS** — a pair that refused the state the reversal (or the
   // in-commit action) left, a body that threw at the judgement of it, and — from `D-42` — **the restart's own
   // budget spent**. The third arm is the one the restart's exhaustion reaches and it names no refusing pair.
   let spelled;
   if (unsettled === true) {
-    spelled = `the constraint ${one.entry.id} could not be asked a state that would settle at `
-      + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — the check was `
-      + `restarted ${RESTART_LIMIT} times and a pair body acted inside the check at every restart, so the `
-      + `restart budget is spent and the check does not pass — ${undoSpelling(undo)}`;
+    // **⟶ AND THE ENTRY NAMES THE PAIR THE CHECK WAS ASKING AND THE ADDRESS IT WAS ASKING AT, 2026-10-28
+    // (`DEF-AL`).** It used to name the FIRST WATCHED pair — a passing one, by id — because registration order
+    // decided it. The `spentAtAsked` arm says plainly WHEN THE BUDGET RAN OUT WITH NO ASK IN FLIGHT, so the
+    // entry never claims to name a pair it cannot know.
+    spelled = spentAtAsked === true
+      ? `the constraint ${one.entry.id} could not be asked a state that would settle at `
+        + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)} — this pair was being `
+        + `asked when the restart budget ran out, it did not refuse anything, a pair body acted inside the `
+        + `check at every restart, the check was restarted ${RESTART_LIMIT} times and the budget is spent, so `
+        + `the check does not pass — ${undoSpelling(undo)}`
+      : `no pair was being asked when the restart budget ran out at ${addressSpelling(one.address)}: the value `
+        + `there is ${standingSpelling(after)} — a pair body acted inside the check without an ask in flight, `
+        + `the check was restarted ${RESTART_LIMIT} times and the budget is spent, so the check does not pass `
+        + `— ${undoSpelling(undo)}`;
   } else if (thrown === null) {
     spelled = `the constraint ${one.entry.id} refused the state the reversal left at `
       + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
       + (said === null ? '' : ` — ${said}`)
       + ` — ${undoSpelling(undo)}`;
   } else {
+    // **⟶ AND THE THROWABLE'S OWN FORM IS PRINTED IN THIS ENTRY — `D-55` ITEM 1, `DEF-AK`, 2026-10-28.** No
+    // attempt stands at a reversal's judgement, so no commit log exists for the kernel to append to: **this
+    // refusal's ONE entry is the log the failure crosses with**, so the value the body threw is named HERE —
+    // the form the catch frame took (`THROWN_FORM`) where the value was converted, and the value's own form
+    // where the tree carried no generator to convert it. **THE ENTRY'S SHAPE, KIND, `seq` AND MEMBER COUNT DO
+    // NOT MOVE**: the form is in the sentence, not in a seventh member and not in a second entry (`D-41` item
+    // `4`'s one-entry arm, which the restoration's cell asserts).
+    const took = THROWN_FORM.get(thrown);
+    const form = typeof took === 'string' ? took : throwableForm(thrown);
     spelled = `the constraint ${one.entry.id} THREW at the judgement of the state the reversal left at `
       + `${addressSpelling(one.address)}: the value there is ${standingSpelling(after)}`
+      + ` — the value it threw was ${form}`
       + ` — ${undoSpelling(undo)}`;
   }
   const entry = {
@@ -2331,7 +2909,18 @@ function reversalRefusal(one, after, said, reversalId, undo, thrown, unsettled =
   // **THE CROSSED `status` IS THE ARM'S OWN AND IS NEVER MINTED** (`DD-40`): rank `20` where a pair refused the
   // state the reversal left, rank `18` where a pair's body threw at the judgement of it (`D-41` item `4`). The
   // sentence beside it was generated for that same code — one source for each (`DD-52`).
-  return { status, message, log: refusalLog(log) };
+  const crossed = packageRefusal({ status, message, log: refusalLog(log) });
+  if (inner !== null) {
+    // THE INNER REFUSAL TRAVELS ON THE REFUSAL THE CALLER CATCHES, under the same symbol and the same
+    // non-enumerable discipline `bodyThrowRefusal` uses: the crossed form's three members are unmoved.
+    Object.defineProperty(crossed, INNER_REFUSAL, {
+      value: inner,
+      writable: false,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  return crossed;
 }
 
 /// **THE ADDRESS'S OWN `<SEGMENT>` SPELLING, JOINED BY `/` AND BARE** — the kernel's own