provident-storeroom 1.2.0 → 1.4.0

package/src/entry/delivery.mjs

@@ -6,7 +6,7 @@ import { arrayClass, classSpelling, hasLoneSurrogate, isPlainObjectValue, target
 import { encodeAddress, encodeOpId, handleWire, inDomainHandle } from './carrier.mjs';
 import { decodeSegments, spellConstraintAddress } from './frame.mjs';
 import { addressSpelling } from './kernel-foundations.mjs';
-import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
+import { entryOf, carryRefusal, commitFile, homeAddressKey, externalCall, commitLogOf, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM } from './state.mjs';
 
 /// `PAR-JS-13`: the returned record is `{op, watched, triggered}` — fresh on every call, never a view.
 ///
@@ -555,7 +555,13 @@ export function terminalArm(state, record) {
       // receiver … A listener that is itself a store member is NOT supported"* — the package's own internal
       // paths (this one and `registerOn`'s re-install) address the store they hold, and only a CALLER's call
       // takes its receiver from `this` (`§1`).
-      carryRefusal(() => commitFile(state.receiver, answer.op.opId), [encodeOpId(answer.op.opId)]);
+      // **⟶ AND THE COMMIT'S OWN LIST GOES WITH THE CALL — `D-53`, 2026-10-28.** A save that fails is a constraint
+      // violated at the write's LAST position, so its refusal must cross carrying the COMMIT's entries (the pass's
+      // `constraint-check` entries and, by the time the caller reads it, the kernel's one `outcome` entry with the
+      // save arm's own `KC-9` in `state`). **THE LIST IS READ OFF THE RECORD THE KERNEL BUILT** (`commitLogOf(record)` — `record[COMMIT_LOG]`,
+      // a symbol key on `CommitRecord`'s own identity — no member is added, `A117` (D6)), and a record carrying none
+      // is a record this package did not build, whose failure keeps the declared `[]`.
+      carryRefusal(() => commitFile(state.receiver, answer.op.opId), [encodeOpId(answer.op.opId)], commitLogOf(record));
     } catch (saveFailure) {
       // **THE FAILURE CARRIES THE VERY THROWABLE AND ITS OWN MARK** (`docs/specs/storeroom-js/surface.md §2.11` clause 9): the kernel's catch
       // reads `SAVE_FAILED_AT_THE_TERMINAL_ARM` to tell a failed save from a body of the delivered set that
@@ -594,9 +600,17 @@ export function terminalArm(state, record) {
   const triggeringAddress = answer === null || answer === undefined || answer.op === null || answer.op === undefined
     ? undefined
     : answer.op.address;
-  // `deliver` is THE SAME loop the post-verb window uses (`docs/specs/storeroom-js/surface.md §2.4` rules 1–3 read once, at both instants): ONE
-  // invocation per DISTINCT handle, and a handle with no registered function fires nothing silently.
-  deliver(state, triggered, triggeringAddress);
+  // **⟶ AND THE ARM PERFORMS THE DELIVERY FOR A KERNEL-DRIVEN WRITE AND FOR NO OTHER ACT — 2026-10-29.** A
+  // `delete`'s delivery is its OWN MEMBER's (`D-49` declares that window the one whose check never ran, and a
+  // request raised there is the witness's and not a pass's); the record is the delete's, so this arm is
+  // reached for it — the `file`-tier save above is the arm's act on BOTH — and the residue's delivery is the
+  // member's. **THE FACT IS THE PACKAGE'S OWN STATE AND NEVER A MEMBER OF ANY RECORD**, and it is `'arm'` on
+  // every path that does not name another, so a write's delivery is exactly where it was.
+  if (state.legDelivery !== 'member') {
+    // `deliver` is THE SAME loop the post-verb window uses (`docs/specs/storeroom-js/surface.md §2.4` rules 1–3 read once, at both instants): ONE
+    // invocation per DISTINCT handle, and a handle with no registered function fires nothing silently.
+    deliver(state, triggered, triggeringAddress);
+  }
   return undefined;
 }
 

package/src/entry/kernel-attempt.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9d`) — the pass: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
+import { KC, KC_TOKENS, SETTLED_ON_THE_PASSING_ARM, SAVE_FAILED_AT_THE_TERMINAL_ARM, TERMINAL_ARM, markBodyThrow, throwableForm, refuse, isKernelRefusal, pairSpelling, addressSpelling, sameAddress, kernelFor, append, appendOwn, ownMember, withdraw, landedOp, landedOpDefect, pairsAtAddress, enterCommitFrame, leaveCommitFrame, commitLogInFlight, sealHandoff } from './kernel-foundations.mjs';
 import { commitAttemptIdOf, terminal, close } from './kernel-terminal.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-3` `runAttempt(store, commit) -> AttemptReport`
@@ -37,6 +37,35 @@ const COMMIT_SCOPE = Symbol.for('provident-storeroom.commit-scope');
 /// (`§1` item 2: `K-1`–`K-5` and no sixth name).
 const RESTART_DRAIN = Symbol.for('provident-storeroom.restart-drain');
 
+/// **`D-54` (b)'s SECOND SPELLING OF THE SAME `Symbol.for` KEY** — the entry writes the restarted check's
+/// refusal onto the report under it (`constraints.mjs`'s `carryRestartRefusal`) and this module reads it back
+/// so the failing arm can answer with the very value the terminal judgement built, exactly as the passing arm
+/// reaches it through `constraintWrite`. **NEITHER SIDE IMPORTS THE OTHER** (`kernel-surface.md §1` item 1's
+/// empty import footprint), the key is invisible to `Object.keys` and to `Object.getOwnPropertyNames`
+/// (`A117` (D6)), and no kernel item is minted (`§1` item 2: `K-1`–`K-6` and no seventh name).
+const RESTART_REFUSAL = Symbol.for('provident-storeroom.restart-refusal');
+
+/// **⟶ `D-54` (b)'s COMPENSATION FLAG — the same `Symbol.for` key `constraints.mjs` spells.** The kernel's
+/// terminal act composes the attempt's rollback THROUGH THE APP'S PUBLISHED `rollback` MEMBER
+/// (`kernel-terminal.mjs`'s `composeRollback`), so that call would otherwise take a restart watch and raise a
+/// request — a phantom the failing pass's drain would then judge, asking pairs at the state the compensation
+/// had just restored to. **`D-42` declares the rule the flag keeps: *"a restart is only ever raised by a
+/// consumer's own `rollback` member call."*** The flag stands on the kernel record for the duration of the one
+/// call, is a symbol key (invisible to `Object.keys`/`Object.getOwnPropertyNames`, `A117` (D6)), and mints no
+/// kernel item (`kernel-surface.md §1` item 2).
+const COMPENSATING = Symbol.for('provident-storeroom.compensating-rollback');
+
+/// **THE KERNEL'S ONE TERMINAL ACT, TAKEN WITH ITS COMPENSATION FLAGGED** — the wrapper every terminal call in
+/// this module uses so the composition inside `terminal` is never mistaken for an action of the caller's.
+function terminalComposed(kernel, attempt, status, message) {
+  kernel[COMPENSATING] = true;
+  try {
+    terminal(kernel, attempt, status, message);
+  } finally {
+    kernel[COMPENSATING] = false;
+  }
+}
+
 /// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON AN INVOCATION'S OWN ENTRY, AND IT IS THIS PASS'S ONE USE OF THE
 /// SEAM'S SIXTH CHANNEL.** **THE RULING, THE ARCHITECT, VERBATIM: *"A constraint's repair needs to stay as part
 /// of the same commit so that it can be tracked as part of the commit process … The original way of maintaining
@@ -69,6 +98,28 @@ function repairInCommit(store, commit, run) {
   return run();
 }
 
+/// **⟶ AND THE CONSTRAINT BODY'S INVOCATION NAMES THE ATTEMPT'S COMMIT TOO — `D-53`, 2026-10-28.**
+///
+/// **THE RULING, VERBATIM: *"Constraints/Repairs should always use the same commit"*** (`strata/decisions.md` ·
+/// `D-53`). **THE INVARIANT THIS FRAME NOW KEEPS IS `D-45`'s *"it should be opening a new commit by default of
+/// entering at the surface"* READ THROUGH `D-53`'s LATER AND NARROWER ONE: a call that NAMES a commit JOINS it,
+/// and a call that names none opens one — and the kernel names the attempt's commit at EVERY invocation of
+/// caller code that belongs to the attempt, a constraint body's as well as a repair body's** (`D-46`'s device,
+/// applied to the second kind of body). **SO A CONSTRAINT NEVER OPENS A COMMIT: the check it is invoked for is
+/// already inside one (`D-44`'s scope) and this name is what makes its verb JOIN that window instead of opening
+/// a second.** **THE LOG IS THE SAME FACT SEEN FROM THE OTHER SIDE**: the entries such a verb mints are the
+/// attempt's own commit's entries, which is what `DEF-AK` measures — *"one inner refusal, two hosts"* — and what
+/// `D-53` dissolved `D-52`'s merge question with (*"the crossed report IS that list"*).
+///
+/// **A LISTENER BODY STILL NAMES NOTHING, AND THAT IS THE INVARIANT AND NOT AN OMISSION**: it is invoked by the
+/// ENTRY at the terminal arm, after the triggering commit has passed its constraints, so *"what the listener
+/// does is a NEW QUESTION and must not inherit the old verdict"* — its own commit, its own list.
+function constraintInCommit(store, commit, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run, commit);
+  return run();
+}
+
 export function runAttempt(store, commitRecord) {
   // THE SEAM, READ BEFORE ANY STATE MOVES: **a store this package did not build carries no such channel, so it
   // is not this package's store and no pass of this kernel may run against it.** The refusal is thrown BEFORE
@@ -91,12 +142,61 @@ export function runAttempt(store, commitRecord) {
   // open — a direct `K-2`/`K-3` drive, `D-44`'s window. **NO COUNT IS MINTED EITHER WAY**: the channel is
   // `openCommit`/`closeCommit` composed, and the count moves only where this call's own opening is the one that
   // took it.
+  // **⟶ AND A FAILING PASS'S TERMINAL STATE IS STILL A JUDGEMENT — `D-54` (b), 2026-10-28, MEASURED.** The bytes
+  // above reached the drain only where the pass ANSWERED A REPORT, so a pass that ended by throwing — a repair
+  // body that reversed the store had then broken the attempt's own re-run, or a delete's pass whose pair
+  // refused after its delivery's reversal — left the request its bodies raised standing, unjudged, with its
+  // effect in the store. **THE REQUEST IS CARRIED TO THE PASS'S TERMINAL JUDGEMENT**: the terminal act has run
+  // and the attempt is closed, so the state the pass left is the state the restarted check is asked at, and the
+  // drain runs here, inside the same scope, exactly as it does on the passing arm. **THE FAILING PASS'S OWN
+  // ANSWER IS NOT RE-SHAPED**: where the restarted check passes, or where the throwable is not the kernel's own
+  // (a caller body's value, a store refusal — each of which must cross as itself), the pass's throwable crosses
+  // unchanged. Only a KERNEL refusal — the pass's own terminal arm — is superseded by the refusal the restarted
+  // check built at that same terminal state, because that check's verdict is the state the pass left.
   return scope(() => {
-    const report = passInCommitScope(store, commitRecord);
-    return drainRestart(store, report);
+    let report;
+    try {
+      report = passInCommitScope(store, commitRecord);
+    } catch (thrown) {
+      return drainFailingPass(store, commitRecord, thrown);
+    }
+    // **⟶ AND THE RECORD IS SEALED AT THE HANDOFF — `D-55` item 6, `DEF-AO`, 2026-10-28.** The drain above is
+    // the LAST act of closing out (it amends the report's own `outcome` and appends the refusal's entry to the
+    // report's list BEFORE this line), so what the seal freezes is the record the driver receives and no record
+    // in flight: `report.log` and the report are `Object.freeze`d, and a later act can neither append to the
+    // commit's list nor re-member the report. **A PASSING ARM IS SEALED TOO** — its list is handed off once.
+    return sealHandoff(drainRestart(store, report), commitLogInFlight(kernelFor(store)) !== null);
   }, commitRecord);
 }
 
+/// **THE FAILING PASS'S DRAIN — `D-54` (b)'s ONE NEW CALL SITE.**
+///
+/// **WHY THE REPORT IS READ AND NOT BUILT**: the pass's terminal act (`kernel-terminal.mjs`'s `terminal`) has
+/// already answered the attempt's ONE five-member report and placed it in the kernel's closed map before it
+/// throws, so the log the drain re-appends onto is the attempt's own list and no second report is minted
+/// (`A117` (D6): no member is added to any record). **A THROWABLE THAT STOOD BEFORE ANY TERMINAL ACT — `KC-2`,
+/// a re-entrant `KC-7`, a store refusal at `K-2` — has no closed report and no request of this pass's window
+/// either**, so it crosses unchanged and the drain is not reached: no pass ran.
+///
+/// **THE ONE PRECEDENCE RULE, STATED ONCE**: a restarted check's refusal supersedes the pass's answer only
+/// where that answer is the KERNEL's own (a `KC`-tokened refusal, `isKernelRefusal`). A constraint body's
+/// throwable is the caller's and crosses as itself (`fail-surface.md §1.1` item `5`), a store verb's refusal
+/// crosses verbatim (`§1.2` item `2`), and neither is re-shaped by a later check's verdict — the request is
+/// still judged and the store still restored by that judgement's own compensating act.
+function drainFailingPass(store, commitRecord, thrown) {
+  const closed = kernelFor(store).closed.get(commitAttemptIdOf(commitRecord));
+  if (closed === undefined) throw thrown;
+  const answered = drainRestart(store, closed);
+  // **⟶ THE FAILING ARM'S RECORD IS SEALED AT ITS OWN HANDOFF — `DEF-AO`.** The drain has already amended the
+  // closed report if the restarted check refused, so the seal stands before this arm picks which value crosses:
+  // the restarted refusal and the pass's own throwable both carry the SAME frozen list (`D-53`), and neither
+  // can be appended to after this line.
+  sealHandoff(answered, commitLogInFlight(kernelFor(store)) !== null);
+  const restarted = answered !== null && typeof answered === 'object' ? answered[RESTART_REFUSAL] : undefined;
+  if (restarted !== undefined && isKernelRefusal(thrown) === true) throw restarted;
+  throw thrown;
+}
+
 /// **THE DRAIN, TAKEN INSIDE THE SCOPE THE PASS JUST ENDED IN.** It hands the store **the report the pass
 /// answered with** and answers the report the kernel returns: unchanged where no request stood or the
 /// restarted check passed, and amended — `outcome` `'failed'` and the refusal's entry in the log — where the
@@ -152,7 +252,7 @@ function passInCommitScope(store, commitRecord) {
   if (terminalArm !== null) {
     // A FAILING LANDING: the arm's own terminal act, its per-op rollback composition, and the throw
     // of `fail-surface.md §1.1`'s form carrying the log.
-    terminal(kernel, attempt, terminalArm.status, terminalArm.message);
+    terminalComposed(kernel, attempt, terminalArm.status, terminalArm.message);
     // **⟶ INSTANT (b) ON THE FAILING ARM, AND IT PRECEDES THE REFUSAL** (`docs/decisions.md` · `A116`
     // (D1); `surface.md §2.4` item 9's table row (b): *"AT THE PASS'S TERMINAL ARM … after the last
     // constraint of the attempt has been evaluated and before `runAttempt` returns to the calling
@@ -239,7 +339,16 @@ function passInCommitScope(store, commitRecord) {
     // `'ok'`; where the failed save's own rollback took it the store answers `JournalOpUnknown` and the
     // composition's floor reads `KC-8` in the ONE `outcome` entry (item 5 (b); item 6 (a)).
     attempt.checkpoint = null;
-    terminal(kernel, attempt, KC.violated,
+    // **⟶ AND THE ARM'S TOKEN IS THE SET'S NINTH MEMBER, `KC-9` — `D-53`'s THIRD RULING, 2026-10-28: *"Open the
+    // token set"*.** **`D-52` MEASURED THE CONTRADICTION THIS CLOSES**: *"a constraint refusal crosses
+    // `ConstraintPassRefused` with terminal `state: 'KC-3'`; and with an in-body reversal meeting the floor,
+    // `ConstraintPassRefused` with terminal `KC-8`; a save failure crosses `FileCommitFailed` with `log: []`, and
+    // the attempt's own log reads `KC-8` — the same token a passing-pair run carries. **SO `KC-8` CROSSES AS BOTH
+    // STATUSES.**"* **THE SAVE ARM THEREFORE GETS A TOKEN OF ITS OWN**, so that a save failure and a constraint
+    // refusal cross with different statuses AND each is derivable from the log's terminal state — **and
+    // `kernel-terminal.mjs`'s precedence clause is what keeps this token through the floor**, which is otherwise
+    // `KC-8` on both arms and would put the contradiction back.
+    terminalComposed(kernel, attempt, KC.saveFailed,
       typeof saveFailure.message === 'string'
         ? saveFailure.message
         : `the attempt's own save at ${addressSpelling(attempt.address)} failed`);
@@ -257,7 +366,10 @@ function passInCommitScope(store, commitRecord) {
   // stand in one log). **AND NOTHING IS APPENDED TO THIS LOG AFTER IT**: the delivered set's bodies ran
   // before this line and reach this attempt's log by no act (`§2.7` item 6), the record this attempt's
   // report carries being the same list this line closes.
-  append(attempt, 'commit', null, attempt.ops[attempt.ops.length - 1].opId,
+  // **⟶ AND ITS ITERATION IS `{ pair: null, op }` — the `commit` entry names NO PAIR and the attempt's LAST OP**
+  // (`kernel-surface.md §2.1` item 3's `LogKind` table; `D-53`'s first ruling, which is what the iteration position
+  // carries).
+  append(attempt, 'commit', { pair: null, op: attempt.ops[attempt.ops.length - 1] },
     `every constraint registered at ${addressSpelling(attempt.address)} passed; the commit stands`);
   return closed;
 }
@@ -343,14 +455,35 @@ function evaluate(kernel, attempt, landing) {
   // alike — and NOT the union of the store's prefix-selected addresses"), WHILE THE OP EVERY EVALUATION
   // CARRIES IS THE LANDING'S OWN — the repair's op where a repair's edit landed, and the attempt's first
   // write where the pass is the commit's own landing.
-  // THE PASS'S OWN EVALUATED SET IS FIXED WHEN THE PASS BEGINS — a SNAPSHOT of the registry's rows for
+  // **⟶ AND THE SET THAT ADDRESS MATERIALISES IS NOW A PREFIX SET, 2026-10-29 (`D-56`).** `RCA-8(g)`
+  // ANNOTATE-BESIDE: **the quotation above stands BYTE-FOR-BYTE as `attempt-lifecycle.md §2.4` item 5 (iv)'s
+  // EXACT-ADDRESS rule — the clause `D-56` names by number and SUPERSEDES**; the architect's own sentence is
+  // *"A listener/constraint should fire when the descendants of its targeted address node change, because the
+  // descendants become part of the object that is read from that address"*, and what it changes here is the
+  // PREDICATE `pairsAtAddress` applies — **the pairs whose own address is a PREFIX of the attempt's, equality
+  // included.** **NO OTHER LINE OF THIS FRAME MOVES**: the address is still the attempt's, the landing's op is
+  // still what every evaluation carries, and the set is still ONE SNAPSHOT taken at this instant.
+  // THE PASS'S OWN EVALUATED SET IS FIXED WHEN THE PASS BEGINS — a SNAPSHOT of the registry's rows AT OR ABOVE
   // the attempt's address AT THAT INSTANT, and never a live view of the registry this pass reads again:
   // "a PASS's evaluated set is FIXED WHEN THE PASS BEGINS — it is every pair registered at the attempt's
   // address AT THAT INSTANT, each evaluated once in clause (ii)'s order", so "A `K-1` THAT RETURNS
   // DURING A PASS APPENDS A PAIR TO THE REGISTRY WITHOUT APPENDING ANY ENTRY TO THAT PASS AND WITHOUT
   // BEING EVALUATED BY IT: the new pair enters the NEXT pass's set" (`attempt-lifecycle.md §2.4` item 5
-  // (iv); `CX-12`). The snapshot is ALSO the set the layer (a) delivery of this run is read over.
+  // (iv); `CX-12`, which `D-56` defers to and does NOT move). **THE SNAPSHOT IS MATERIALISED ONCE PER RUN AND
+  // READ BY THE WHOLE RUN** — the loop below, the repair arm's `list` and `releasePending`'s check-off all read
+  // THIS ONE array — **and it is ALSO the set the layer (a) delivery of this run is read over.**
   const list = pairsAtAddress(kernel, attempt.address);
+  // **⟶ AND THE COMMIT THE INVOCATIONS OF THIS RUN NAME — `D-55` ITEM 3's DELETE-SHAPED ATTEMPT, 2026-10-29.**
+  // **A WRITE'S ATTEMPT NAMES ITS `CommitRecord`** (`attempt.record`, the object `K-2` built and adopted), and
+  // every verb a body calls under it JOINS that commit (`D-46`). **A DELETE'S ATTEMPT HAS NO `CommitRecord`** —
+  // it lands no write, so there is no adoption, no residue and no save — **and it still owes the same
+  // invariant**: `D-53`'s *"Constraints/Repairs should always use the same commit"* is not a rule about records
+  // but about the COMMIT, and a body's write under a delete's pass that named nothing would OPEN a second commit
+  // and start a second list. **SO THE ATTEMPT CARRIES ITS COMMIT'S NAME** (`kernel-commit.mjs`'s
+  // `commitRemoval` sets `attempt.name` to the one member `commitAttemptIdOf` reads) **and this frame hands THE
+  // NAME where a record exists and THE RECORD where it does** — one expression, and on the write path it is the
+  // very object it always was, so no byte of the write's own invocation moves.
+  const commitName = attempt.record === undefined ? attempt.name : attempt.record;
   // THE ATOMIC LANDING EVALUATION'S OWN ARM-TAKING IS `attempt-lifecycle.md §2.4` item 4's arms, read
   // over THE PAIR THAT FAILED AT THAT OP (`kernel-surface.md §2.3` item 1; `§2.4`: `KC-3` where that pair
   // is NOT in `ran` before this run and no repair is registered for it; `KC-6` where it IS in `ran` and
@@ -383,24 +516,40 @@ function evaluate(kernel, attempt, landing) {
       // THE ENTRY IS OPENED BEFORE THE BODY RUNS, so a body that reads the record's own log mid-flight
       // reads its own evaluation's entry — and it is WITHDRAWN where the body returns nothing
       // (`kernel-surface.md §2.5` item 1; `PAR-C-6`).
-      append(attempt, 'constraint-check', pair.id, op.opId, `the evaluation of ${pair.id}`);
+      // **⟶ AND IT IS NAMED BY THE ITERATION — the pair AND the op, one identity — `D-53`'s FIRST RULING**
+      // (`kernel-foundations.mjs`'s `append`; `D-52`'s rule 1: *"an entry carries the PAIR identity and the OP
+      // identity together … they are one identity"*).
+      append(attempt, 'constraint-check', { pair, op }, `the evaluation of ${pair.id}`);
       const check = attempt.log[attempt.log.length - 1];
       let outcome;
+      // **⟶ AND THE FRAME: every list the body's own verbs append to between these two lines is THIS commit's
+      // list** (`D-53`'s first invariant). The frame is pushed for exactly the invocation and popped in a
+      // `finally`, so a throwable leaves no frame standing and no later write of this commit inherits a frame it
+      // does not own.
+      enterCommitFrame(kernel, attempt.log);
       try {
-        // **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A constraint
-        // body is EXTERNALLY-SUPPLIED FUNCTION code entering the surface, **and it has no commit in hand to
-        // name** — it is handed the five-member `AttemptContext` and no commit at all (`kernel-surface.md §2.3`
-        // item 1) — so **a verb it calls OPENS ITS OWN COMMIT** rather than joining the one this pass runs in:
-        // *"It should be opening a new commit by default of entering at the surface"*. **THE NAME IS AN
-        // INVOCATION'S AND NOTHING ELSE'S**: it is set before the call and restored after it, on the throwing arm
-        // too, and the kernel's own acts of this pass name the pass's commit through `COMMIT_SCOPE` — so an
-        // ordinary write still opens ONE commit and a callback's verb is still an act of its own.
-        outcome = externalCall(attempt.store, () => pair.constraint(context));
+        // **⟶ AND THE BODY IS INVOKED WITH THE ATTEMPT'S COMMIT NAMED, 2026-10-28 (`D-53`).** `D-45` invoked it
+        // with nothing named and `D-46` narrowed that for repairs alone; **`D-53` states the invariant both halves
+        // obey: a CONSTRAINT never opens a commit and a REPAIR never opens one, while a listener's write always
+        // does.** The name is an INVOCATION's and nothing else's: it is set before the call and restored after it,
+        // on the throwing arm too, so an ordinary write still opens ONE commit and a callback's verb is still an
+        // act of its own.
+        outcome = constraintInCommit(attempt.store, commitName, () => pair.constraint(context));
       } catch (body) {
         // A body that threw returned nothing, so no `constraint-check` entry stands and the attempt is
         // closed (`PAR-C-6`; `NX-2`; `composition-and-states.md §2.7` item 13).
         withdraw(attempt, check);
-        terminal(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed`);
+        // **⟶ AND THE THROWABLE'S OWN FORM ENTERS THE COMMIT'S LOG — `D-55` ITEM 1, `DEF-AK`, 2026-10-28.**
+        // The architect, verbatim: *"Include a thrown message in the message log. Obviously."* **THE ENTRY IS
+        // THE ONE THE TERMINAL ACT ALREADY APPENDS**: this arm closes the attempt with its ONE `outcome` entry
+        // (`composition-and-states.md §2.7` item 13), and NO second entry and NO fifth `kind` is minted —
+        // `constraint-check` was WITHDRAWN above and must not come back (`fail-surface.md §1.1` item 1 (b),
+        // which the kernel-level cells assert as *"NO entry stands for the pair whose body returned nothing"*).
+        // **SO THE TERMINAL ENTRY'S SENTENCE CARRIES THE FORM** (`throwableForm`: the string's own text, the
+        // object's own `message` member, or the kind of value it was, read off own members only), and the
+        // closed report's list — the list the crossing hands the caller — holds it at that entry's `seq`.
+        terminalComposed(kernel, attempt, null, `the constraint ${pair.id} threw; the attempt is closed — the `
+          + `value it threw was ${throwableForm(body)}`);
         // **⟶ AND THE VALUE IS MARKED HERE, BY THE FRAME THAT CAUGHT IT FROM THE BODY — `DEF-S`, 2026-10-26,
         // on the architect's ruling *"Expand the returned error set for both S/N"*.** The mark is what the
         // entry's `constraintCrossing` converts on, and an UNMARKED value still crosses as itself
@@ -409,6 +558,10 @@ function evaluate(kernel, attempt, landing) {
         // `kernel-foundations.mjs`). The throwable's own identity is unmoved at THIS layer: a kernel-level
         // caller still meets the very value the body threw.
         throw markBodyThrow(body, attempt.address, attempt.log);
+      } finally {
+        // THE FRAME GOES WITH THE INVOCATION, ON EVERY ARM (`D-53`): a frame left standing would make the NEXT
+        // write of this store join a commit it is not inside.
+        leaveCommitFrame(kernel);
       }
 
       // THE CONSTRAINT'S OWN OUTCOME — A CLOSED THREE-ARM SET (`PAR-C-5`). A value outside the three
@@ -487,7 +640,7 @@ function evaluate(kernel, attempt, landing) {
       // INSTANT IT IS APPENDED — "THE OP THE REPAIR PRODUCED WHERE IT PRODUCED ONE, ELSE THE OP IT WAS
       // INVOKED FOR" (`kernel-surface.md §2.5` item 1's `repair-run` row) — so on EVERY arm the entry
       // names THE OP THIS EVALUATION CARRIED, and only the arm that produced an op rewrites it below.
-      append(attempt, 'repair-run', pair.id, op.opId, 'the pair\'s repair was attempted');
+      append(attempt, 'repair-run', { pair, op }, 'the pair\'s repair was attempted');
       const entry = attempt.log[attempt.log.length - 1];
       let result;
       const repairContext = {
@@ -529,7 +682,10 @@ function evaluate(kernel, attempt, landing) {
         // so a repair that supplies it at `write`'s fourth position names the same commit by its own hand, and
         // the two spellings cannot disagree: **the entry's position wins where it is supplied, and this name is
         // the fallback where it is not** (`state.mjs`'s `openCommit`).
-        result = repairInCommit(attempt.store, attempt.record, () => repair(repairContext));
+        // **⟶ AND THE FRAME STANDS FOR THIS INVOCATION TOO (`D-53`'s first invariant): the repair's own verbs
+        // append to the attempt's list, and the frame is what makes `K-2` join rather than open.**
+        enterCommitFrame(kernel, attempt.log);
+        result = repairInCommit(attempt.store, commitName, () => repair(repairContext));
       } catch (body) {
         // THE REPAIR-RUN ENTRY IS APPENDED BEFORE THE THROW, and the attempt's outcome entry carries
         // `KC-4` (`ck_states_a_repair_body_that_throws_reaches_the_caller_unconverted`).
@@ -575,7 +731,7 @@ function evaluate(kernel, attempt, landing) {
         if (storeCode !== null) {
           entry.message = `the repair ${pair.id} was attempted and the store refused its own edit — the `
             + `store's answer is ${storeCode}`;
-          terminal(kernel, attempt, KC.repairFailed, entry.message);
+          terminalComposed(kernel, attempt, KC.repairFailed, entry.message);
           // **⟶ AND THE FORM THAT CROSSES TO THE CALLER IS THE KERNEL'S OWN** (`kernel-surface.md §2.3`
           // item 2 (iii): the attempt *"moves to `FAILING` with `KC-4`"*, and *"the thrown form's `status`
           // is NEVER a store member"*) — **the very form the FAILING arm above throws**, carrying the
@@ -584,8 +740,10 @@ function evaluate(kernel, attempt, landing) {
           // body's own arm and this conversion is the refused-verb's.
           refuse(attempt.throwState, attempt.throwMessage, attempt.log);
         }
-        terminal(kernel, attempt, KC.repairFailed, `the repair ${pair.id} threw; the attempt is closed`);
+        terminalComposed(kernel, attempt, KC.repairFailed, `the repair ${pair.id} threw; the attempt is closed`);
         throw body;
+      } finally {
+        leaveCommitFrame(kernel);
       }
 
       // THE REPAIR'S OWN RESULT — A CLOSED TWO-ARM SET (`PAR-C-8`), WHOSE SUCCESS ARM'S THIRD MEMBER

package/src/entry/kernel-commit.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9c`) — the commit act: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling } from './kernel-foundations.mjs';
+import { KC, refuse, inDomainAddress, kernelFor, attemptHeldAt, appendOwn, addressSpelling, commitLogInFlight, COMMIT_LOG } from './kernel-foundations.mjs';
 // ---------------------------------------------------------------------------------------------
 // `K-2` `commit(store, address, tier, value) -> CommitRecord`
 // ---------------------------------------------------------------------------------------------
@@ -53,6 +53,17 @@ export function commit(store, address, tier, value) {
   // `appendOwn`), and NO ANSWER MOVES: the same segments, the same order, a FRESH array as before.
   const addressCopy = [];
   for (let i = 0; i < address.length; i += 1) appendOwn(addressCopy, address[i]);
+  // **⟶ AND THE ATTEMPT'S LOG IS THE COMMIT'S LOG — `D-53`, 2026-10-28.** A write the kernel reaches from inside
+  // an invocation it made of caller code that BELONGS TO AN ATTEMPT (a constraint body's verb at a landing, a
+  // repair body's write, a registration's body) is part of that attempt's commit, so it JOINS that commit's one
+  // list; a write reached with no such frame standing — a caller's own write, and a LISTENER BODY's write, which
+  // the entry invokes at the terminal arm — OPENS a commit and starts a fresh list, because *"the triggering
+  // commit already passed constraints"* and what the listener does now is a new question (`D-53`).
+  // **ONE LIST PER COMMIT AND NO MERGE**: the entries a nested write mints are this list's entries, their `seq`
+  // is this list's ordinal, and the crossed report of the enclosing refusal IS this list (`D-52`'s rule 2 is
+  // dissolved rather than answered — there are not two lists to reconcile).
+  const joined = commitLogInFlight(kernel);
+  const commitLog = joined === null ? [] : joined;
   const attempt = {
     ref: { id: `attempt-${kernel.attempts}` },
     store,
@@ -65,7 +76,8 @@ export function commit(store, address, tier, value) {
     // reads `triggered` as the store's returned set VERBATIM).
     write: null,
     ops: [],
-    log: [],
+    // THE COMMIT'S OWN LIST, BY REFERENCE (`D-53`): the attempt holds a reference to it and mints no second one.
+    log: commitLog,
     ran: [],
     appliedRepairs: [],
     rollback: [],
@@ -111,6 +123,18 @@ export function commit(store, address, tier, value) {
     pending: [],
   };
   attempt.record = record;
+  // **⟶ AND THE LOG TRAVELS ON THE COMMIT'S OWN RECORD, UNDER A SYMBOL KEY — `D-53`.** The record is the
+  // commit's JS identity: the fourth position names it, the entry adopts it, and the terminal arm holds it when
+  // it must tell a failed save's crossing WHICH LOG the commit's verdict stands in (`delivery.mjs`'s save arm
+  // reads it through `state.mjs`'s `commitLogOf`, which spells the same key). **NO MEMBER IS ADDED**: `Object.keys` and
+  // `Object.getOwnPropertyNames` read past a symbol (`A117` (D6)), so `CommitRecord` keeps its four members and
+  // every census of it moves by nothing.
+  Object.defineProperty(record, COMMIT_LOG, {
+    value: commitLog,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
   // **⟶ INSTANT (a)'S SEAM CALL IS WITHDRAWN, 2026-10-18** (`docs/specs/storeroom-constraints/kernel-surface.md
   // §2.1` item 2's clause of that date: *"the call of `settle(record)` THIS ITEM MAKES AT INSTANT (a) … IS
   // WITHDRAWN"*). **WITH ONE ACTOR THERE IS NOTHING TO WITHHOLD**: the record is built and complete BEFORE the
@@ -164,3 +188,168 @@ export function commit(store, address, tier, value) {
   return record;
 }
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ ADDED 2026-10-29 — `commitRemoval`: THE DELETE-SHAPED COMMIT ACT. `D-55` ITEM 3, `DEF-X`.**
+//
+// **THE RULING, THE ARCHITECT, VERBATIM: *"A delete is an editing verb and must pass constraints. This includes
+// all of the relevant commit and message logic."*** (`strata/decisions.md` · `D-55` item `3`). **THE MEASURED
+// OBSTACLE IT ANSWERS WAS PRINTED, NOT ASSUMED**: a `delete` opens its own commit window and reaches the
+// addon's `delete` directly — **no `K-2`, no `K-3`, no log and no terminal entry** — and **the only pass shape
+// the artefact had (`K-2` then `K-3`) LANDS A WRITE FIRST** (`storeAfter = {"c":2}`), so any pass driven
+// through it judges a state the delete is not in. **SO THE DELETE GETS AN ATTEMPT OF ITS OWN KIND, AND THIS IS
+// IT** — the commit act's remove-shaped sibling, and NOT a re-used `K-2`.
+//
+// **IT OPENS LIKE ANY OTHER, AND THE TWO THINGS IT SHARES WITH `K-2` ARE THE TWO THAT MATTER:**
+//   * **`D-44` IS KEPT BY THE CALLER AND RE-CHECKED HERE**: the attempt is opened inside the delete's own
+//     commit window (the member opens it before this act is reached, `index.mjs`'s `delete`), so no check this
+//     pass runs stands outside one — and a store this package did not build carries no commit scope at all, so
+//     `runAttempt` fails closed exactly as it does for a write.
+//   * **`D-53` IS KEPT BY THE SAME READ `K-2` TAKES**: `commitLogInFlight` answers the enclosing invocation's
+//     list where this delete was called from caller code that BELONGS TO an attempt (a constraint body's
+//     `delete`, a repair's), and `null` at a consumer's own call. **ONE LIST PER COMMIT, AND A DELETE'S ENTRIES
+//     JOIN IT** — there is no second list and no merge.
+//
+// **WHAT IT DOES NOT DO IS LAND A WRITE.** `K-2` calls the store's `write`. **This act mints an `AttemptRecord`
+// of kind `delete` and calls THE STORE'S OWN LEG THE CALLER HANDS IT** — the addon's `delete`, already crossed
+// by the entry — so **the state the attempt is judged at is the state the delete LEFT and never a state a probe
+// wrote.** The act's own answer (`removal`) is the delete's declared receipt: its `op` is the DELETE's journal
+// op and so THE ATTEMPT'S ONE LANDING (`attempt.ops`), which is what the pass's context carries and what the
+// failing arm's composition rolls back; its `triggered` set is the store's own returned set, kept on
+// `attempt.write` for the terminal act's discard rule exactly as a failed write's is.
+//
+// **⟶ AND IT MINTS THE `CommitRecord` TOO, 2026-10-29 — THE FOUR MEMBERS, THE SYMBOL-KEYED LOG, AND THE ONE
+// IDENTITY THE WHOLE COMMIT'S MACHINERY IS KEYED BY.** The `DEF-X` build measured the four residuals this
+// closes and printed them; each is a `K-2` behaviour that follows from the record and from nothing else:
+//   * **ADOPTION** — the record is what `K-2` hands the store's own verb at its fourth position, and what the
+//     entry holds so that the TERMINAL ARM performs the delivery and the save. A delete has no fourth position
+//     (its declared arity is `delete(address, tier)`), so the entry adopts the record it holds the same way it
+//     adopts a write's: it stands the delete's own returned receipt in the leg slot the terminal arm reads
+//     (`index.mjs`'s `delete`), and the RECORD is what `settleArm` hands that arm.
+//   * **THE `pending` RESIDUE** — written exactly as `K-2` writes it: the returned set WHOLE at this instant,
+//     and a handle leaves it only by its own pair's check-off (`releasePending`) or by the failing arm's
+//     discard (`terminal`). **NO SIFT**: the delete's own returned set is carried, member for member.
+//   * **THE `file`-TIER SAVE** — the terminal arm's save is gated on the record this act mints
+//     (`SETTLED_ON_THE_PASSING_ARM`, placed by the passing arm) and on the leg the entry adopted, so a
+//     `file`-tier delete SAVES its own op exactly as a `file`-tier write saves its own.
+//   * **`K-4`/`K-5` BY REF** — the record carries `attempt`, the `AttemptRef` those two items accept, so the
+//     delete's log and report are answerable after a PASSING delete and not only from a refusal's log.
+// **THE RECORD'S FOUR MEMBERS AND ITS SYMBOL-KEYED LOG ARE `K-2`'S OWN, SPELLED THE SAME WAY**: the log is
+// defined with `Object.defineProperty` under `COMMIT_LOG` and is not a fifth member (`A117` (D6)), so a census
+// of any record moves by nothing.
+//
+// **THE `D-3` ARM IS KEPT AND A HELD ADDRESS IS JOINED RATHER THAN REFUSED** (the ground is printed at the act
+// itself and it is a measurement, not a preference: a repair has no fourth position to name its commit at, so
+// a `KC-7` here would make a lawful repair's `delete` unlawful):
+//   * **A REFUSED STORE VERB LEAVES NO ATTEMPT** (`D-3`'s neighbour): the addon's own refusal crosses back
+//     unchanged, and because the attempt is placed in `kernel.live` only AFTER the act answered an op, a
+//     refused delete holds nothing and closes nothing — `K-2`'s own rule, reached by the same structure.
+//   * **AND AN ACT THAT REMOVED NOTHING IS `D-3`'S SUCCESS WITH `tiers: []`**: no journal entry was appended,
+//     so there is no op, no landing to judge and no edit to undo — **this act answers `null`, the entry mints
+//     no pass, and nothing is added to any log.** A delete that changed nothing cannot be refused by a
+//     constraint, because it is not an edit. **NO `KC` TOKEN IS MINTED FOR IT AND NO TENTH TOKEN EXISTS.**
+//
+// **WHAT IT ANSWERS.** The attempt record, open and live — **carrying `attempt.record`, the `CommitRecord` this
+// act minted** — for the pass the caller runs next (`entry`'s `constraintDelete`), or `null` on the `D-3` arm.
+// **NO KERNEL ITEM IS MINTED**: `kernel-surface.md §1` item
+// `2` closes the kernel's EXPORT SET at the five `K-1`–`K-5` items and that barrel
+// (`src/constraint-kernel.mjs`) is untouched — this function is a part module's own act, reached by the entry
+// the way every other kernel part is, and it is named by no `K-` number.
+export function commitRemoval(store, address, tier, remove) {
+  const kernel = kernelFor(store);
+  // **NO `KC-7` REFUSAL IS TAKEN AT THIS OPENING, AND THE ASYMMETRY WITH `K-2` IS NAMED BECAUSE IT IS
+  // MEASURED.** `K-2` refuses a second attempt at a HELD address, and a REPAIR at that address is admitted only
+  // because it NAMES the enclosing commit at `write`'s fourth position (`D-46`). **A delete has no such
+  // position** — the member's arity is the declared `delete(address, tier)` and this pass changes no
+  // declaration — so a repair that edits by `delete` at the attempt's own address (the shape
+  // `tests/integration/js-constraints/constraint-kernel-negatives.test.mjs`'s `P-NEG-22` drives, and
+  // `parameter-semantics.md §2.7` blesses) would be refused by a hold it had no way to name its way out of,
+  // and a lawful repair would stop being lawful. **SO THIS ACT REFUSES NOTHING ON THAT GROUND**: it joins the
+  // address as a second attempt record and places itself in `kernel.live` below, which keeps the hold the
+  // enclosing attempt already has (`attemptHeldAt` stays true there for every nested `K-2`, unchanged) and
+  // takes the hold itself where the address was free. **THE COUNT `reversalAtRest` READS IS UNMOVED IN
+  // MEANING**: an open delete attempt IS an open attempt, so a reversal raised inside its pass is a step.
+  kernel.attempts += 1;
+  // THE ATTEMPT'S ADDRESS IS A LOCAL INDEX COPY of the caller's array, never `address.slice()` (`D-35`'s read
+  // half; the same form `commit` above takes and for the same measured reason).
+  const addressCopy = [];
+  for (let i = 0; i < address.length; i += 1) appendOwn(addressCopy, address[i]);
+  // THE COMMIT'S ONE LIST, BY REFERENCE, OR A FRESH ONE WHERE THIS DELETE OPENED THE COMMIT (`D-53`).
+  const joined = commitLogInFlight(kernel);
+  const ref = { id: `attempt-${kernel.attempts}` };
+  const attempt = {
+    // **THE KIND — the discriminator the write's attempt never needed**: an attempt that landed no write is
+    // judged against the DELETE's op, and it now owes the SAME `CommitRecord` a write's attempt does.
+    kind: 'delete',
+    ref,
+    // **THE NAME THE BODIES THIS PASS INVOKES JOIN** (`D-46`/`D-53`). The record below is that name from now
+    // on — `kernel-attempt.mjs`'s `evaluate` hands `attempt.record` to the invocation channel where one exists —
+    // and this one-member object STANDS AS THE RECORD'S ABSENT ARM, so a body's write joins the delete's commit
+    // instead of opening a second one on either arm.
+    name: { attempt: ref },
+    store,
+    address: addressCopy,
+    tier,
+    // THE SUBJECT IS WHAT THE DELETE REMOVES, NOT A VALUE: the after-state is absence, and the op carries what
+    // stood before it (its `before`) per tier (`D-55` item `3`'s *"the addresses and the tiers"*).
+    value: undefined,
+    commit: undefined,
+    // The store's own returned set, kept whole for the terminal act's discard rule (`terminal`).
+    write: null,
+    // THE DELETE'S JOURNAL OP IS THE ATTEMPT'S ONE LANDING — empty until the act answers one.
+    ops: [],
+    log: joined === null ? [] : joined,
+    ran: [],
+    appliedRepairs: [],
+    rollback: [],
+    checkpoint: null,
+    checkedOff: [],
+    status: 'open',
+    report: null,
+  };
+  // **THE RECORD, BUILT BEFORE THE STORE'S LEG IS CALLED — `K-2`'s OWN INSTANT AND `K-2`'s OWN FOUR MEMBERS**
+  // (`kernel-surface.md §2.1` item 2; `A112` re-spells the fourth: *"`pending` IS THE WHOLE RETURNED SET"*).
+  // Its members are FILLED from the receipt below; it is built here so the commit's identity exists before the
+  // act lands anything, exactly as it does for a write.
+  const record = {
+    attempt: attempt.ref,
+    op: null,
+    triggered: [],
+    pending: [],
+  };
+  attempt.record = record;
+  // AND THE COMMIT'S LIST TRAVELS ON IT UNDER THE SYMBOL KEY, VERBATIM AS `K-2` DEFINES IT (`D-53`): ONE LIST
+  // PER COMMIT, and the record is the identity it hangs from. **NO MEMBER IS ADDED** (`A117` (D6)).
+  Object.defineProperty(record, COMMIT_LOG, {
+    value: attempt.log,
+    enumerable: false,
+    writable: false,
+    configurable: true,
+  });
+  // **THE STORE'S OWN LEG, AND IT IS THE CALLER'S** (`kernel-surface.md §1` item 1's empty import footprint:
+  // this module reaches no entry and no addon of its own; the thunk is the entry's own addon call).
+  const removal = remove();
+  // `D-3`: nothing was removed — no entry was appended, so there is no op to name and no state to judge. **NO
+  // ATTEMPT IS OPENED AND NO RECORD CROSSES**: the receipt is the whole answer, its `tiers` and `triggered`
+  // empty, and the record built above dies with this attempt.
+  if (removal === null || typeof removal !== 'object' || removal.op === null || removal.op === undefined) {
+    attempt.status = 'closed';
+    return null;
+  }
+  attempt.write = removal;
+  attempt.ops = [removal.op];
+  // **THE RECEIPT'S OWN MEMBERS, READ OFF IT VERBATIM — `K-2`'s three assignments at its own record's name.**
+  // `triggered` is the store's returned set and `pending` is that set WHOLE (no sift; `A112`), so the residue
+  // the terminal arm delivers and the failing arm's discard reads are the delete's own, unfiltered.
+  record.op = removal.op;
+  record.triggered = removal.triggered;
+  record.pending = removal.triggered.slice();
+  // THE ATTEMPT IS PLACED LIVE HERE, BEFORE THE FIRST BODY OF THE PASS RUNS: the store's own `delete` invokes
+  // nothing, so there is no window between the act and this line in which a caller's code could interleave —
+  // and the address is held from this instant through the pass and its terminal act, exactly as `K-2` holds
+  // it. **THE MAP IS ALSO THE COUNT OF OPEN ATTEMPTS** the restart's at-rest discriminator reads
+  // (`constraints.mjs`'s `reversalAtRest`), so a reversal raised inside this pass is a step and not a
+  // judgement.
+  kernel.live.set(ref.id, attempt);
+  return attempt;
+}
+