provident-storeroom 1.2.0 → 1.4.0

package/src/entry/kernel-foundations.mjs

@@ -38,12 +38,23 @@
 // ---------------------------------------------------------------------------------------------
 // `fail-surface.md §2` — THE KERNEL'S OWN CLOSED STATE SET, `8` MEMBERS AND NO NINTH.
 // ---------------------------------------------------------------------------------------------
+// **⟶ AND THE SET OPENS TO `9` ON 2026-10-28 — `D-53`'s THIRD RULING, THE ARCHITECT'S WORD: *"Open the token
+// set"*** (`strata/decisions.md` · `D-53`; `D-52`'s rule 3 is its measurement: **`KC-8` CROSSED AS TWO
+// STATUSES** — a constraint refusal whose composition met the floor, and a failed save — **so neither arm was
+// derivable from the log's terminal state**). **THE SENTENCE ABOVE STANDS BYTE-FOR-BYTE AND IS READ THROUGH
+// THIS ONE: `9` MEMBERS AND NO TENTH, ON `14` SITES.** **THE APPENDED MEMBER IS `KC-9`, THE SAVE ARM'S OWN —
+// `ConstraintSaveFailed`** — so a save failure and a constraint refusal cross with DIFFERENT statuses AND each
+// is derivable from the log's terminal state: the save arm's ONE `outcome` entry carries `KC-9` and a constraint
+// refusal's carries `KC-3`/`KC-5`/`KC-6`/`KC-8` (`KC-9`'s own row, `kernel-attempt.mjs`'s save arm, and
+// `kernel-terminal.mjs`'s precedence clause: **the FLOOR DOES NOT OVERWRITE THIS TOKEN, which is what keeps the
+// two arms apart where the save's own composition meets a floor code**).
 // `fail-surface.md §1.1` ITEM 1 (a) — THE ONE SPELLING, AND IT IS THE TOKEN: a refusal's `status` carries
-// `KC-1`…`KC-8` and NOTHING ELSE. The full names (`ConstraintViolated` …) are LABELS: they keep exactly
+// `KC-1`…`KC-9` and NOTHING ELSE. The full names (`ConstraintViolated` …) are LABELS: they keep exactly
 // one declared use — the `name` column of `§2`'s table, and a citation beside a token — and NO clause
 // spells a member's VALUE as a name. `status` and `LogEntry.state` therefore read THE SAME TOKEN STRING,
-// related by IDENTITY (`§1.1` item 1 (c)). THE CENSUS DOES NOT MOVE: `8` members (`2 + 2 + 2 + 1 + 1`)
-// on `13` sites (`1 + 4 + 4 + 3 + 1`).
+// related by IDENTITY (`§1.1` item 1 (c)). THE CENSUS MOVES BY THE RULING AND BY NOTHING ELSE:
+// `8 → 9` members (`2 + 2 + 2 + 1 + 1 + 1`) on `13 → 14` sites (`1 + 4 + 4 + 3 + 1 + 1`, the last being the
+// save arm's own, `kernel-attempt.mjs`).
 export const KC = {
   address: 'KC-1', // ConstraintAddressRefused
   arg: 'KC-2', // ConstraintArgRefused
@@ -53,9 +64,10 @@ export const KC = {
   repeat: 'KC-6', // ConstraintRepeat
   attemptOpen: 'KC-7', // ConstraintAttemptOpen
   rollbackFloor: 'KC-8', // ConstraintRollbackFloor
+  saveFailed: 'KC-9', // ConstraintSaveFailed
 };
 
-/** The eight tokens above, as the ONE list a member's own value is checked against — the kernel's own
+/** The nine tokens above, as the ONE list a member's own value is checked against — the kernel's own
  *  token is NEVER named as a store code (`fail-surface.md §1.1` item 1 (a); `§2`'s `KC-4` row). */
 export const KC_TOKENS = Object.values(KC);
 
@@ -217,6 +229,61 @@ export function markBodyThrow(thrown, address, log) {
   }
 }
 
+/// **⟶ ADDED 2026-10-28 — `D-55` ITEM 1, THE ARCHITECT, VERBATIM: *"Include a thrown message in the message
+/// log. Obviously."*** **THE MEASURED DEFECT (`DEF-AK`):** a constraint body that threw its own `Error`
+/// crossed as the rank-`18` `ConstraintBodyThrew` whose `log` carried **only the attempt's `outcome` entry** —
+/// the thrown value's own literal occurred **zero times** in it — while the crossed sentence said *"a
+/// constraint body's throwable crosses as this refusal"*. **The commit's log now carries the throwable's own
+/// form, written into the ONE `outcome` entry the terminal act appends at the frame that caught the body —
+/// before the attempt is disposed of and before the record is handed off** (`kernel-attempt.mjs`'s `evaluate`;
+/// no second entry and no fifth `kind` is minted).
+///
+/// **WHAT THE FORM IS, AND WHY IT NAMES WHAT IT READ RATHER THAN A CLASS.** The value is the CALLER'S OWN —
+/// it may be an `Error`, a string, a number, an object with no `message`, a `Proxy` — so the spelling is
+/// built from **own data members only** (`ownMember`, `[[GetOwnProperty]]`, `D-35`'s read half) and from the
+/// language's own `typeof`. **NO PROTOTYPE IS CONSULTED**: `instanceof`, `constructor.name` and
+/// `Object.prototype.toString` all walk a chain a caller owns, and a `Proxy`'s trap would RUN here, on a
+/// refusal path. **AND A CLASS IS NEVER CLAIMED**: *"an object whose own `message` member is the string …"*
+/// is true of an `Error` and of a plain object alike, which is what the reading supports.
+///
+/// **THE FORM IS NAMED AND NOT SILENTLY STRINGIFIED**: a thrown string is *"a string whose text is …"*, a
+/// number *"a number whose value is …"*, a thrown `void 0` *"no value at all"*, an object without a `message`
+/// *"an object carrying no own string `message` member"*. A consumer therefore reads WHAT KIND of value the
+/// body threw beside whatever text it carried.
+///
+/// **IT IS TOTAL, AND THE ONLY READ THAT COULD RUN CALLER CODE IS THE GUARDED ONE**: this frame invokes
+/// nothing of the caller's — `ownMember` is `[[GetOwnProperty]]` and consults no chain — and the one trap it
+/// can trip (a `Proxy`'s `getOwnPropertyDescriptor`) is inside a `try`, whose arm past it answers a sentence of
+/// this frame's own. **NO `undefined` IS EVER PRINTED** (`native/contract.md §8.2` property (c); the `DEF-Q`
+/// sweep reads every entry's message for it): a thrown `void 0` says *"no value at all"* and a missing member
+/// is named as absent rather than spelled.
+export function throwableForm(thrown) {
+  if (thrown === null) return '`null`';
+  const kind = typeof thrown;
+  if (kind === 'undefined') return 'no value at all (the body threw `void 0`)';
+  if (kind === 'string') return `a string whose text is ${JSON.stringify(thrown)}`;
+  if (kind === 'number') return `a number whose value is ${String(thrown)}`;
+  if (kind === 'boolean') return `a boolean whose value is ${String(thrown)}`;
+  if (kind === 'bigint') return `a bigint whose value is ${String(thrown)}`;
+  if (kind === 'symbol') return 'a symbol, which carries no text a log can print';
+  if (kind === 'function') return 'a function, which carries no message';
+  let message;
+  let name;
+  try {
+    message = ownMember(thrown, 'message');
+    name = ownMember(thrown, 'name');
+  } catch {
+    // A `Proxy` whose `getOwnPropertyDescriptor` trap throws cannot be read at all: this frame says so and
+    // runs nothing further (`D-35`: the refusal path invokes no caller code it was not already handed).
+    return 'an object this frame could not read, so its form is not printed';
+  }
+  const named = typeof name === 'string' && name.length > 0 ? ` named ${JSON.stringify(name)}` : '';
+  if (typeof message === 'string') {
+    return `an object${named} whose own \`message\` member is the string ${JSON.stringify(message)}`;
+  }
+  return `an object${named} carrying no own string \`message\` member`;
+}
+
 /// **WHETHER A VALUE IS A REFUSAL THIS KERNEL BUILT** — the entry's crossing and this kernel's own repair
 /// arm both ask this and nothing else.
 ///
@@ -385,6 +452,37 @@ export function sameAddress(left, right) {
   return true;
 }
 
+/**
+ * **⟶ ADDED 2026-10-29 — `isAddressPrefix`: THE PASS'S OWN MEMBERSHIP TEST, AND IT IS `D-56`'S SENTENCE IN
+ * ONE FUNCTION.** The architect, verbatim: *"A listener/constraint should fire when the descendants of its
+ * targeted address node change, because the descendants become part of the object that is read from that
+ * address"* (`strata/decisions.md` · `D-56`). **THE GROUND IS SEMANTIC AND NOT A PREFERENCE: the value read at
+ * a prefix CONTAINS its subtree, so a change at a descendant CHANGES what a read at the ancestor returns** —
+ * and a pair standing at the ancestor therefore **judges an object that moved.**
+ *
+ * **THE SET, STATED ONCE: a pair is asked when THE ACT'S ADDRESS IS AT OR BELOW THE PAIR'S ADDRESS** — *"the
+ * pair's address is a prefix of the act's address (equality included)"* (`D-56`). **So `isAddressPrefix(standing,
+ * act)` is `true` exactly where the pair stands AT the act's address OR AT ONE OF ITS ANCESTORS**, and `false`
+ * for a pair standing at a DESCENDANT — the unruled direction, which `D-56` requires to be MEASURED rather than
+ * implemented, and which this predicate therefore does not reach.
+ *
+ * **IT IS STRUCTURAL AND SEGMENT-WISE, WITH `string` AND `number` DISTINGUISHED, EXACTLY AS `sameAddress` IS**
+ * (`P: docs/pending.md · (M-3)` item (iv)): a pair at `['a', 0]` is NOT asked by an act at `['a', '0']`, so the
+ * widening changes WHICH DEPTHS are members and NOT how a segment is compared. **A SEGMENT COUNT OF ZERO IS A
+ * PREFIX OF EVERY ADDRESS** — the root pair's own reading, and the same one the trigger set's prefix rule gives.
+ */
+export function isAddressPrefix(prefix, address) {
+  if (!Array.isArray(prefix) || !Array.isArray(address)) return false;
+  if (prefix.length > address.length) return false;
+  for (let i = 0; i < prefix.length; i += 1) {
+    const a = prefix[i];
+    const b = address[i];
+    if (typeof a !== typeof b) return false;
+    if (a !== b) return false;
+  }
+  return true;
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE KERNEL'S OWN CALLER-SIDE STATE — **THE INSTANCE OWNS IT, IN A SLOT ON THE INSTANCE ITSELF**, so
 // two stores never share a registry, this module retains no store of its own, and NOTHING STANDS AT
@@ -484,6 +582,11 @@ export function kernelFor(store) {
       live: new Map(),
       closed: new Map(),
       attempts: 0,
+      // **⟶ AND THE COMMIT'S FRAME, 2026-10-28 (`D-53`)**: the stack of attempts whose commit the kernel is, at
+      // this instant, invoking caller code inside. `K-2` reads its top and joins that attempt's list; a write
+      // reached with no frame standing OPENS a commit and starts its own list. It is the instance's own, exactly
+      // as `live`/`closed` are (`D-30`), so no two stores share a frame and no module-level stack exists.
+      frames: [],
       store,
     };
     // **THE SLOT IS DEFINED AND THE RECORD IS PUBLISHED IN THE SAME ACT** (`Object.defineProperty`, exactly as
@@ -613,16 +716,129 @@ export function ownMember(value, name) {
   return descriptor.value;
 }
 
+// ---------------------------------------------------------------------------------------------
+// **⟶ THE MESSAGE LOG BELONGS TO THE COMMIT, NOT TO THE ATTEMPT — `D-53`, 2026-10-28.**
+//
+// **THE ARCHITECT, VERBATIM: *"If it's part of the same commit, then it uses the same message log. If it opens a
+// new commit, it uses the new commit's message log. Constraints/Repairs should always use the same commit.
+// Listeners should open a new commit, because the triggering commit already passed constraints"***
+// (`strata/decisions.md` · `D-53`). **A COMMIT IS THE UNIT OF WORK AND AN ATTEMPT IS THE CONSTRAINT-JUDGED WRITE
+// INSIDE IT**, so a commit that holds several attempts — a check, its repair, the repair's own write, the re-run
+// — holds ONE list, and every one of those attempts appends to it: **`attempt.log` IS the commit's list, carried
+// by reference, and it is not a copy of anybody's.**
+//
+// **WHAT THAT DISSOLVES, SAID BECAUSE IT WAS ASKED AS A QUESTION.** `D-52`'s rule 2 asked where a nested
+// attempt's report is merged into its host's, and how a merged entry keeps *"its own attempt identity"* when
+// `seq` is *"the ordinal of the list it stands in"* and the six declared members leave no room for a seventh.
+// **THERE WAS NEVER A MERGE TO PERFORM: a constraint body's write is part of the same commit, so its entries
+// ARE this list's entries, the crossed report IS this list, no entry is renumbered and `seq` keeps its
+// declaration because there is ONE list.** `DEF-AK`'s *"one inner refusal, two hosts"* is the measurement of it.
+//
+// **THE KEY IS A `Symbol.for` SPELLING ON THE COMMIT'S OWN RECORD, AND BOTH SIDES SPELL IT** (`A117` (D6)): the
+// entry's terminal arm attaches this list to a failed save's crossing, and it holds the `CommitRecord` and
+// nothing else — so the list travels ON the record under a symbol key that `Object.keys` and
+// `Object.getOwnPropertyNames` read past, and the record keeps its FOUR declared members.
+export const COMMIT_LOG = Symbol.for('provident-storeroom.commit-log');
+
+// ---------------------------------------------------------------------------------------------
+// **⟶ THE HANDOFF'S OWN SEAL — `D-55` ITEM 6, `DEF-AO`, ADDED 2026-10-28.** The architect, verbatim:
+// *"Attempts don't log. This is what the commits are for. The commits have their log handed off to the client
+// and are dropped after closing out."* **SO THE RECORD IS HANDED OFF ONCE, AT THE END OF THE COMMIT'S OWN
+// PROCESSING, AND A RECORD THAT CHANGES AFTER THE HANDOFF IS NOT A RECORD.**
+//
+// **WHAT WAS MEASURED BEFORE THIS ACT EXISTED.** The drain amends the REPORT a pass already closed — it sets
+// `outcome` and appends the refusal's entry to the report's list — and the list it appends to is THE COMMIT'S
+// OWN, held by reference by every attempt of the commit, the crossed refusals included. A consumer that took
+// the closed report (or a refusal carrying that list) before the drain therefore held a record that moved
+// under it. **FREEZING AT THE SEAL MAKES THE HANDED-OFF RECORD FINAL**: the drain's amendment happens BEFORE
+// this call (it is part of closing out), and nothing after it can append, renumber or re-member the list.
+//
+// **WHAT IT FREEZES, AND WHY THE LOG'S SEAL IS THE COMMIT'S.** `D-53` makes the message log THE COMMIT'S: an
+// attempt's `log` is that one list, carried by reference, and every attempt of the commit appends to it — a
+// constraint body's nested write, a repair's write, the re-run. **SO THE REPORT IS SEALED AT EVERY ATTEMPT'S
+// HANDOFF AND THE LIST IS SEALED AT THE HANDOFF OF THE ATTEMPT WHOSE SCOPE OWNS IT** (the one whose commit is
+// not an enclosing invocation's list, read off `commitLogInFlight`): freezing the list at a NESTED attempt's
+// handoff would stop the enclosing attempt's own `append` and turn a lawful write into a raw host `TypeError`
+// — measured, and the reason the `shared` argument exists. **THE LIST IS SEALED WITH ITS COMMIT**, which is
+// what *"the commits have their log handed off to the client and are dropped after closing out"* says.
+//
+// **IT FREEZES TWO THINGS AND ONLY TWO**: the report's `log` array (where this attempt's scope owns it) and
+// the report itself. **NO MEMBER MOVES, NO MEMBER IS ADDED, AND THE LIST'S IDENTITY IS UNCHANGED** — `D-53`'s
+// *"the crossed report IS that list"* is a statement about WHICH array crosses, and the same array crosses
+// (frozen): `K-5`, `K-4` and every refusal built from it read the same entries at the same `seq` ordinals.
+// **A PASSING ATTEMPT'S REPORT IS SEALED TOO** — its log is handed off exactly once and drops with the commit.
+export function sealHandoff(report, shared) {
+  if (report === null || typeof report !== 'object') return report;
+  // THE REPORT'S OWN `log` MEMBER, READ AS A MEMBER OF THE OBJECT THIS FRAME BUILT (`kernel-terminal.mjs`
+  // places the commit's list there and nothing else): an absent or non-array member is not this act's, and
+  // `refusalLog`'s own rule (`surface.md §2.5` item 4) is that a `log` is a list on every arm.
+  const log = report.log;
+  if (shared !== true && Array.isArray(log) === true) Object.freeze(log);
+  Object.freeze(report);
+  return report;
+}
+
+// **THE COMMIT'S FRAME — THE ONE STRUCTURE THAT MAKES "THE SAME COMMIT" A FACT RATHER THAN A CONVENTION.** It is
+// a per-instance stack on the kernel record (`kernel.frames`, created by `kernelFor`), pushed by the kernel
+// around each invocation IT makes of caller code that belongs to an attempt — a constraint body at a landing,
+// at a registration's evaluation, at its re-run; a repair body — and popped in a `finally`.
+//
+// **`K-2` READS IT AND NOTHING ELSE DECIDES THE LOG**: a write the kernel reaches from inside such an
+// invocation JOINS the innermost frame's list; a write reached from anywhere else — a caller's own top-level
+// write, and A LISTENER BODY'S WRITE, which the ENTRY invokes at the terminal arm with no frame of this
+// kernel's standing — OPENS a commit and therefore starts a list of its own (`D-53`: *"Listeners should open a new
+// commit, because the triggering commit already passed constraints"* — what the listener saw was already
+// approved, so what it does now is a NEW QUESTION and must not inherit the old verdict).
+export function enterCommitFrame(kernel, log) {
+  appendOwn(kernel.frames, { log });
+}
+
+/** The pop, and it is a local index loop for the reason every other list surgery here is (`contract.md §2.1`'s
+ *  clause of 2026-10-24 on `F7-1`): no `Array.prototype.pop` is read on a path a caller's prototype can reach. */
+export function leaveCommitFrame(kernel) {
+  const kept = [];
+  for (let i = 0; i + 1 < kernel.frames.length; i += 1) appendOwn(kept, kernel.frames[i]);
+  kernel.frames = kept;
+}
+
+/** **THE LOG OF THE COMMIT THE KERNEL IS INSIDE, OR `null` WHERE IT IS INSIDE NONE** — the one read `K-2` takes
+ *  to decide whether this write joins a commit or opens one. */
+export function commitLogInFlight(kernel) {
+  return kernel.frames.length === 0 ? null : kernel.frames[kernel.frames.length - 1].log;
+}
+
 // ---------------------------------------------------------------------------------------------
 // THE MESSAGE LOG (`kernel-surface.md §2.5` item 1; `PAR-C-4`). SIX MEMBERS, `seq` ASCENDING FROM
 // `1`, ONE KIND PER ENTRY: `constraint-check` | `repair-run` | `commit` | `outcome`.
-// ---------------------------------------------------------------------------------------------
-export function append(attempt, kind, id, opId, message, state) {
+//
+// **⟶ AND THE ENTRY IS NAMED BY AN ITERATION AND NOT BY TWO LOOSE IDENTITIES — 2026-10-28, `D-53`'s FIRST
+// RULING: *"Both combined to identify which constraint iteration it is on"*.** **THE ARCHITECT'S ANSWER TO
+// `D-52`'s rule 1, read with `D-53`'s own gloss: *"an entry carries the PAIR identity and the OP identity
+// together, and the PAIR identifies WHICH CONSTRAINT of that pair's evaluations is being spoken about … The two
+// columns are not alternatives — they are one identity"*.** **THE SUBJECT OF AN ENTRY IS THE ITERATION, AND AN
+// ITERATION IS A PAIR AT AN OP** — which is why no single acted-upon object could supply both, and why the old
+// `(attempt, kind, id, opId, message, state)` signature (two loose strings in two adjacent positions) could be
+// fed one value where the other belonged.
+//
+// **SO THE SIGNATURE TAKES THE ITERATION AS ONE OBJECT AT ONE POSITION, and reads its two members as its OWN
+// data members** (`D-35`'s read half: `[[GetOwnProperty]]` and never a `[[Get]]` that walks a caller's chain):
+//   * `iteration.pair` — the registry row (`{ addresses, id, constraint }`) the entry speaks about, or `null`
+//     where the kind names none (the `commit` entry names no pair, and the `outcome` entry names one only where
+//     the arm has one);
+//   * `iteration.op` — the journal op the iteration is judged at, or `null` where the kind names none.
+// **`id` IS READ OFF THE PAIR AND `opId` OFF THE OP**: a caller cannot put an id in the op's place, because
+// there is no place for one.
+export function append(attempt, kind, iteration, message, state) {
+  const held = iteration !== null && typeof iteration === 'object' ? iteration : null;
+  const pair = held === null ? undefined : ownMember(held, 'pair');
+  const op = held === null ? undefined : ownMember(held, 'op');
+  const id = pair === undefined || pair === null || typeof pair.id !== 'string' ? null : pair.id;
+  const opId = op === undefined || op === null || typeof op.opId !== 'string' ? null : op.opId;
   appendOwn(attempt.log, {
     seq: attempt.log.length + 1,
     kind,
-    id: id === undefined ? null : id,
-    opId: opId === undefined ? null : opId,
+    id,
+    opId,
     message,
     state: state === undefined ? null : state,
   });
@@ -759,31 +975,57 @@ function opSpelling(value) {
  * replacement for `byAddress`'s index, declared at `contract.md §2.8` item 6 (`HL-DD-6`) and
  * `kernel-selection.md §3` item 1.
  *
- * **THE SET IS THE PAIRS WHOSE OWN ADDRESS IS THE ATTEMPT'S — selected by an EXACT-ADDRESS match and NEVER
- * widened to `triggered`'s prefix set** (`P: docs/pending.md · (AA-1)`, verbatim: *"the pass selects the rows
+ * **⟶ THE PREDICATE IS WIDENED FROM EXACT ADDRESS TO PREFIX, 2026-10-29 — `D-56`, AND THE CLAUSE BELOW STANDS
+ * BYTE-FOR-BYTE AS THE RULE THIS ONE SUPERSEDES.** `RCA-8(g)` ANNOTATE-BESIDE: **the paragraph that stood here
+ * read** *"THE SET IS THE PAIRS WHOSE OWN ADDRESS IS THE ATTEMPT'S — selected by an EXACT-ADDRESS match and NEVER
+ * widened to `triggered`'s prefix set"* (`P: docs/pending.md · (AA-1)`, verbatim: *"the pass selects the rows
  * whose address IS the triggering address, which PRESERVES the EXACT-ADDRESS RULE rather than widening it to
- * `triggered`'s prefix set"*; `contract.md §2.8` item 1).
+ * `triggered`'s prefix set"*; `contract.md §2.8` item 1), **and the architect has superseded it**, verbatim:
+ * *"A listener/constraint should fire when the descendants of its targeted address node change, because the
+ * descendants become part of the object that is read from that address"* (`strata/decisions.md` · `D-56`).
+ * **THE TWO CLAUSES `D-56` NAMES BY NUMBER ARE `HL-8` ITEM 1'S OWN SENTENCE AND
+ * `attempt-lifecycle.md §2.4` ITEM 5 (iv)'s EXACT-ADDRESS RULE — both superseded, both annotated in place, and
+ * neither rewritten.**
+ *
+ * **THE SET IS NOW THE PAIRS WHOSE OWN ADDRESS IS A PREFIX OF THE ATTEMPT'S — equality included — WHICH IS
+ * `isAddressPrefix(standing, address)` AND IS `D-56`'s ONE SENTENCE**: a pair at `['tabs']` IS asked for a
+ * delete at `['tabs','landingPage']`, a pair at `['tabs','landingPage']` IS asked for that same delete, and a
+ * pair at `['tabs','landingPage','x']` is NOT asked because the act did not change it (**the unruled direction,
+ * measured and not implemented** — `D-56`'s own terms). **THE REASON IS THE READ:** the value read at a prefix
+ * contains its subtree, so a descendant's change changes what the ancestor's read returns, and the ancestor pair
+ * **judges an object that moved.**
  *
- * **IT IS A SCAN, AND THE COST IS PRICED AND ACCEPTED** (`P: docs/pending.md · (AA-1)`, verbatim: *"selecting
- * rows by address is a scan over `kernel.pairs` … THAT GROUND WAS WRONG AND IS WITHDRAWN: the store names the
- * ADDRESS, and the kernel selects"*).
+ * **IT IS STILL A SCAN, AND THE COST IS STILL PRICED AND ACCEPTED** (`P: docs/pending.md · (AA-1)`, verbatim:
+ * *"selecting rows by address is a scan over `kernel.pairs` … THAT GROUND WAS WRONG AND IS WITHDRAWN: the store
+ * names the ADDRESS, and the kernel selects"*) — **and `D-56` re-prices it not at all**: the scan reads one
+ * prefix test per standing address instead of one equality test per standing address, on the same rows.
  *
- * **AND THE RESULT IS MATERIALISED ONCE, WHICH IS WHAT IMPLEMENTS `CX-12`'s *"the pass's evaluated set is
- * FIXED WHEN THE PASS BEGINS"*** (`P: docs/pending.md · R-B3`'s snapshot clause; `contract.md §2.8` item 6):
- * the returned list is a fresh array, so a `K-1` that returns DURING the pass enters the NEXT pass's set and
- * no earlier one, and a pair PURGED mid-pass is still evaluated by the pass that began with it
- * (`kernel-selection.md §3` item 5).
+ * **AND THE RESULT IS STILL MATERIALISED ONCE, WHICH IS WHAT IMPLEMENTS `CX-12`'s *"the pass's evaluated set is
+ * FIXED WHEN THE PASS BEGINS"*** (`P: docs/pending.md · R-B3`'s snapshot clause; `contract.md §2.8` item 6;
+ * `D-56`'s third deferrer, which changes WHAT is materialised and not WHEN): the returned list is a fresh array,
+ * so a `K-1` that returns DURING the pass enters the NEXT pass's set and no earlier one, and a pair PURGED
+ * mid-pass is still evaluated by the pass that began with it (`kernel-selection.md §3` item 5). **THE PASS READS
+ * THIS LIST AND NEVER THE REGISTRY**, and **`D-56` says nothing that moves that**: the ancestors are members of
+ * the SAME one snapshot, taken at the SAME instant.
  *
- * **THE ORDER IS THE PAIR'S FIRST-REGISTRATION ORDER AT THE ADDRESS** — `attempt-lifecycle.md:193`'s *"clause
- * (ii)'s first-registration order"* — **and `kernel.pairs`' own `Map` iteration supplies it**, which is the
- * order the ruling says is preserved *"by the store's own returned order, not by an index's append order"*
- * (`P: docs/pending.md · M-3`, its closing sentence; `contract.md §2.8` item 6's `HL-DD-6`).
+ * **THE ORDER IS STILL THE PAIR'S FIRST-REGISTRATION ORDER — `HL-8` ITEM 6's RULE SURVIVES `D-56` — AND THE
+ * ANCESTORS INTERLEAVE INTO THAT ONE ORDER RATHER THAN FORMING A SECOND.** `attempt-lifecycle.md:193`'s *"clause
+ * (ii)'s first-registration order"* **is supplied by `kernel.pairs`' own `Map` iteration**, which is the order
+ * the ruling says is preserved *"by the store's own returned order, not by an index's append order"*
+ * (`P: docs/pending.md · M-3`, its closing sentence; `contract.md §2.8` item 6's `HL-DD-6`). **THE WIDENING ADDS
+ * NO ITERATION AND NO SORT**: `D-39`'s registration sequence is the `Map`'s insertion order over the pair rows,
+ * the one loop below walks it once, and **a row is admitted or not by its own `addresses` member** — so an
+ * ancestor registered FIRST is asked FIRST, an ancestor registered THIRD is asked THIRD, **interleaved with the
+ * act's own pairs by the one sequence both stand in.** There is no "ancestors first", no "ancestors last", and
+ * no second list: **one order, one list, one snapshot.** **EACH ELEMENT IS EVALUATED AT MOST ONCE** — the `break`
+ * below is that rule, so a pair standing at N addresses of which two are prefixes of the act is reached once
+ * (`contract.md §2.6` item 5).
  */
 export function pairsAtAddress(kernel, address) {
   const out = [];
   for (const [key, pair] of kernel.pairs) {
     for (const standing of pair.addresses) {
-      if (sameAddress(standing, address)) {
+      if (isAddressPrefix(standing, address)) {
         appendOwn(out, key);
         break;
       }

package/src/entry/kernel-registration.mjs

@@ -1,5 +1,5 @@
 // `D-13` (`docs/L1/kernel-subdivision.md` §1 part `9b`) — the registration act, its evaluation, and the registry's removal: bytes moved from `bindings/js/src/constraint-kernel.mjs`; no logic changed.
-import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsAtAddress, externalCall } from './kernel-foundations.mjs';
+import { KC, KERNEL_REFUSAL, markBodyThrow, refuse, inDomainAddress, inDomainId, pairRowAt, sameAddress, kernelFor, append, appendOwn, landedOp, pairsAtAddress, enterCommitFrame, leaveCommitFrame } from './kernel-foundations.mjs';
 
 /// **⟶ ADDED 2026-10-27 — `D-46`'s NAME ON A REPAIR INVOCATION'S OWN ENTRY, SPELLED HERE AS
 /// `kernel-attempt.mjs` SPELLS IT.** **THE RULING, THE ARCHITECT, VERBATIM: *"A constraint's repair needs to stay
@@ -31,6 +31,19 @@ function repairInCommit(store, commit, run) {
   if (typeof channel === 'function') return channel(run, commit);
   return run();
 }
+
+/// **⟶ AND THE CONSTRAINT BODY'S INVOCATION AT THE REGISTRATION INSTANT NAMES THE REGISTRATION'S OWN COMMIT —
+/// `D-53`, 2026-10-28: *"Constraints/Repairs should always use the same commit"*.** `D-46` named the commit for
+/// the repair alone; **`D-53` states the invariant both kinds of caller-authored body obey, and a CONSTRAINT BODY
+/// IS A CHECK: the commit the registering verb opened (`addConstraint`'s bracket, `docs/specs/storeroom-js/
+/// surface.md §4.1`) is the commit it is asked inside, so a verb it calls JOINS that window and never opens a
+/// second.** **A LISTENER BODY STILL NAMES NOTHING**: the entry invokes it at the terminal arm, where *"the
+/// triggering commit already passed constraints"*, so what it does is a new question (`D-53`).
+function constraintInCommit(store, commit, run) {
+  const channel = store !== null && typeof store === 'object' ? store[EXTERNAL_CALL] : undefined;
+  if (typeof channel === 'function') return channel(run, commit);
+  return run();
+}
 // ---------------------------------------------------------------------------------------------
 // `K-1` `register(store, address, id, constraint) -> Handle`
 // ---------------------------------------------------------------------------------------------
@@ -247,6 +260,13 @@ function withdrawRegistration(kernel, address, id, fresh, home) {
  * invocation below is NOT wrapped — a throwing body reaches the caller as the very value it threw.
  */
 function registrationEvaluation(kernel, store, address, id, constraint) {
+  // **⟶ THE REGISTRATION'S OWN COMMIT AND ITS OWN ONE LIST — `D-53`, 2026-10-28.** A registration is a commit
+  // (`addConstraint`'s and `constraintOn`'s brackets open one, and `3-bis` (a) already declares *"the
+  // `CommitRecord` of the registration act"*), so the record is built FIRST and the list beside it: **a verb the
+  // body calls is part of this commit, its entries are this list's entries, and the synthetic attempt a repair
+  // needs (state `3`) is an attempt of this same commit** — it appends to this list and mints no second one.
+  const commitRecord = { attempt: null, op: null, triggered: [], pending: [] };
+  const commitLog = [];
   // **⟶ AMENDED 2026-10-26 (`DEF-S`; the architect's ruling, verbatim: *"Expand the returned error set for
   // both S/N"*): THE BODY'S THROW IS MARKED AT THE FRAME THAT CAUGHT IT, and no attempt stands at this
   // instant (`null`), so the mark carries the `[]` its clause declares. **THE THROWABLE'S IDENTITY IS
@@ -255,16 +275,23 @@ function registrationEvaluation(kernel, store, address, id, constraint) {
   // unmarked throw is still the caller's own (`markBodyThrow`, `kernel-foundations.mjs`).
   let outcome;
   const context = registrationContext(store, address, null);
+  // **⟶ AND THE BODY IS INVOKED WITH THE REGISTRATION'S COMMIT NAMED — `D-53`, 2026-10-28.** The clause this
+  // replaces read *"the body is invoked with nothing named … so a verb it calls OPENS ITS OWN COMMIT"*
+  // (`D-45`, `D-46` item `1`), and **`D-53`'s invariant reverses it for constraints: *"Constraints/Repairs should
+  // always use the same commit"*** — a constraint body is asked, and the check it is asked by is this commit.
+  // **THE FRAME IS PUSHED FOR EXACTLY THE INVOCATION AND POPPED IN A `finally`**, so a nested write appends to this
+  // registration's list and a throwable leaves no frame standing.
+  // **THE CONTEXT IS BUILT ABOVE THE INVOCATION** (`kernel-surface.md §2.3` item 1), so the store read the context
+  // owes is this verb's own act and not the body's.
+  enterCommitFrame(kernel, commitLog);
   try {
-    // **⟶ AND THE BODY IS INVOKED WITH NOTHING NAMED, 2026-10-27 (`D-45`, `D-46` item `1`).** A constraint body
-    // is EXTERNALLY-SUPPLIED FUNCTION code entering the surface **and it has no commit in hand to name** — its
-    // five-member context carries none (`kernel-surface.md §2.3` item 1) — so **a verb it calls OPENS ITS OWN
-    // COMMIT** rather than joining the registering verb's (*"It should be opening a new commit by default of
-    // entering at the surface"*). **THE CONTEXT IS BUILT ABOVE THE INVOCATION**, so the store read the context
-    // owes is this verb's own act and not the body's.
-    outcome = externalCall(store, () => constraint(context));
+    outcome = constraintInCommit(store, commitRecord, () => constraint(context));
   } catch (body) {
-    throw markBodyThrow(body, address, null);
+    // **AND THE MARK CARRIES THIS COMMIT'S LIST** (`markBodyThrow`'s second slot): a registration-time body that
+    // threw after its own verbs appended carries those entries to the crossing, where `[]` used to be.
+    throw markBodyThrow(body, address, commitLog);
+  } finally {
+    leaveCommitFrame(kernel);
   }
   // THE OUTCOME IS `PAR-C-5`'S CLOSED THREE-ARM SET, read as the landing pass reads it: `true` is the pass
   // arm; an object carrying `message` is the violation arm (its `repair`, where present, the repair the
@@ -277,9 +304,10 @@ function registrationEvaluation(kernel, store, address, id, constraint) {
     : null;
   // STATE 2 — THE STATE VIOLATES IT AND NO REPAIR IS REGISTERED. Nothing is attempted and no attempt is
   // opened; the refusal carries the store's code and the row's own slots.
-  if (repair === null) return registrationRefusal(address, id, []);
-  // STATE 3 — THE REPAIR IS ATTEMPTED, on the synthetic attempt `3-bis` (a) declares.
-  return registrationAttempt(kernel, store, { address, id, repair });
+  if (repair === null) return registrationRefusal(address, id, commitLog);
+  // STATE 3 — THE REPAIR IS ATTEMPTED, on the synthetic attempt `3-bis` (a) declares — **the attempt of THIS
+  // commit, holding THIS list by reference** (`D-53`).
+  return registrationAttempt(kernel, store, { address, id, repair, log: commitLog, commit: commitRecord });
 }
 
 /// **THE FIVE-MEMBER EVALUATION CONTEXT** (`kernel-surface.md §2.3` item 1's clause of 2026-10-17), built
@@ -392,11 +420,14 @@ function registrationAttempt(kernel, store, pair) {
     tier: null,
     value: undefined,
     // `commit` — THE REGISTRATION ACT'S OWN `CommitRecord` (`3-bis` (a)): this kernel's four members, with
-    // no write's op and no write's triggered set, because a registration lands no `K-2` of its own.
-    commit: { attempt: null, op: null, triggered: [], pending: [] },
+    // no write's op and no write's triggered set, because a registration lands no `K-2` of its own. **⟶ IT IS THE
+    // RECORD THE EVALUATION ALREADY BUILT AND NAMED (`D-53`), not a second one**, so the commit the constraint
+    // body was asked inside and the commit its repair joins are ONE.
+    commit: pair.commit,
     write: null,
     ops: [],
-    log: [],
+    // **AND THE LIST IS THAT COMMIT'S OWN, BY REFERENCE** (`D-53`).
+    log: pair.log,
     ran: [],
     appliedRepairs: [],
     rollback: [],
@@ -411,9 +442,12 @@ function registrationAttempt(kernel, store, pair) {
   // pair is appended to BOTH `ran` and `appliedRepairs` (`3-bis` (b): the pair JOINS both members — of the
   // SYNTHETIC attempt, and of no other). **THE PAIR ENTERS `ran` BEFORE THE REPAIR RUNS**, which is that
   // arm's own ordering and is what makes the repeat arms reachable at the re-run below.
-  append(attempt, 'constraint-check', pair.id, null, `the evaluation of ${pair.id}`);
+  // **⟶ AND THE TWO ENTRIES ARE NAMED BY THE ITERATION — `D-53`'s first ruling.** This arm names no OP (`3-bis`
+  // (a)'s synthetic attempt has landed nothing when these are appended): the pair stands, the op is the declared
+  // `null` absence, and the `repair-run` entry's `opId` is rewritten below where the repair lands one.
+  append(attempt, 'constraint-check', { pair, op: null }, `the evaluation of ${pair.id}`);
   appendOwn(attempt.ran, key);
-  append(attempt, 'repair-run', pair.id, null, 'the pair\'s repair was attempted at registration');
+  append(attempt, 'repair-run', { pair, op: null }, 'the pair\'s repair was attempted at registration');
 
   let result;
   const repairContext = registrationRepairContext(store, address, pair.id, attempt.commit);
@@ -428,6 +462,8 @@ function registrationAttempt(kernel, store, pair) {
     // that context at `write`'s fourth position names the same commit by its own hand, and the two spellings
     // cannot disagree (the entry's position wins where it is supplied, and the invocation's name is the fallback
     // where it is not — `state.mjs`'s `openCommit`).
+    // **AND THE FRAME STANDS FOR THIS INVOCATION TOO (`D-53`)**: the repair's verbs append to this commit's list.
+    enterCommitFrame(kernel, attempt.log);
     result = repairInCommit(store, attempt.commit, () => pair.repair(repairContext));
   } catch (body) {
     // A REPAIR WHOSE BODY THROWS IS A FAILED REPAIR AND THE REGISTRATION IS REFUSED — the caller's act is
@@ -437,6 +473,8 @@ function registrationAttempt(kernel, store, pair) {
     // that expected the body's own value out of `addConstraint` has read a route no clause declares.
     closeRegistrationAttempt(kernel, attempt);
     return registrationRefusal(address, pair.id, attempt.log);
+  } finally {
+    leaveCommitFrame(kernel);
   }
 
   const ok = result !== null && typeof result === 'object' && result.ok === true;
@@ -483,11 +521,18 @@ function registrationRerun(kernel, attempt, produced) {
   // **THE ADDRESS IS IN HAND ONE FRAME ABOVE the `byAddress.get` call that stood here**, and the store→kernel
   // channel is `record` alone (`A117` (D6) forbids a fifth member).
   //
-  // **AND THE SELECTION IS AN EXACT-ADDRESS MATCH, NEVER A PREFIX ONE**: the pass's set is the pairs WHOSE OWN
-  // ADDRESS IS THE ATTEMPT'S, which preserves `attempt-lifecycle.md §2.4` item 5 (iv)'s exact-address rule
-  // rather than widening it to the store's prefix-selected `triggered` (`P: docs/pending.md · (AA-1)`;
-  // `contract.md §2.8` item 1). **EACH ELEMENT IS EVALUATED AT MOST ONCE**, so a pair standing at N addresses
-  // whose two addresses both match is reached once (`contract.md §2.6` item 5).
+  // **AND THE SELECTION IS A PREFIX MATCH ON A PAIR'S OWN ADDRESS, AS OF 2026-10-29 (`D-56`).** `RCA-8(g)`
+  // ANNOTATE-BESIDE: **the sentence that stood here read** *"the pass's set is the pairs WHOSE OWN ADDRESS IS THE
+  // ATTEMPT'S, which preserves `attempt-lifecycle.md §2.4` item 5 (iv)'s exact-address rule rather than widening
+  // it to the store's prefix-selected `triggered`"* (`P: docs/pending.md · (AA-1)`; `contract.md §2.8` item 1) —
+  // **and `D-56` supersedes that rule**: *"A listener/constraint should fire when the descendants of its targeted
+  // address node change, because the descendants become part of the object that is read from that address"*.
+  // **SO THE SET HERE IS `pairsAtAddress`'s AND MOVES WITH IT** — the pairs whose own address is a PREFIX of the
+  // attempt's, equality included — because a registration's re-run is not a second kind of pass and mints no
+  // second membership rule. **THE WIDENING IS THE FUNCTION'S AND NOT THIS MODULE'S**: the call below is byte-for-
+  // byte what it was, and the registration instant inherits `D-56` by CALLING the one selection function.
+  // **EACH ELEMENT IS EVALUATED AT MOST ONCE**, so a pair standing at N addresses whose two addresses are both
+  // prefixes of the act is reached once (`contract.md §2.6` item 5).
   const list = pairsAtAddress(kernel, attempt.address);
   for (const key of list) {
     const pair = kernel.pairs.get(key);
@@ -500,17 +545,26 @@ function registrationRerun(kernel, attempt, produced) {
       attempt: attempt.ref,
       op: produced,
     };
+    // **⟶ AND THE RE-RUN'S BODIES ARE OF THIS COMMIT TOO — `D-53`.** The clause this replaces read *"this body is
+    // invoked with nothing named too … the third of the three that invoke a caller-authored constraint body"*
+    // (`D-45`): **the three frames name the attempt's commit now, and the registration's re-run names the same
+    // one its repair joined.** The context is built ABOVE the invocation.
+    enterCommitFrame(kernel, attempt.log);
     try {
-      // **⟶ AND THIS BODY IS INVOKED WITH NOTHING NAMED TOO, 2026-10-27 (`D-45`, `D-46` item `1`)** — the
-      // re-run's frame is the third of the three that invoke a caller-authored constraint body, and it names no
-      // commit exactly as the registration evaluation and the landing's pass do. The context is built ABOVE the
-      // invocation.
-      outcome = externalCall(attempt.store, () => pair.constraint(context));
+      outcome = constraintInCommit(attempt.store, attempt.commit, () => pair.constraint(context));
     } catch (body) {
       // **⟶ ADDED 2026-10-26 (`DEF-S`, the same ruling): a body thrown at the synthetic attempt's re-run is
       // marked at this frame too — the mark carries the attempt's own log and address, and the entry's
       // crossing converts a marked value only** (`markBodyThrow`, `kernel-foundations.mjs`).
+      // **⟶ AND NEITHER THIS FRAME NOR THE REGISTRATION-TIME EVALUATION ABOVE APPENDS A THROWABLE ENTRY, 2026-10-28
+      // — `DEF-AK`'s RECORDED ARM IS THE LANDING'S.** The re-run appends no `constraint-check` entry for the
+      // evaluation it threw in (the pair's own function ran at the registration instant), and no `outcome`
+      // entry stands because this throwable propagates before any terminal act — so there is no entry of the
+      // closed four this frame could honestly extend, and no fifth `kind` is minted for it. The registration
+      // instant's `log` is `surface.md §2.5` item 4's declared `[]` and stays it (`DEF-S`'s own cell reads it).
       throw markBodyThrow(body, attempt.address, attempt.log);
+    } finally {
+      leaveCommitFrame(kernel);
     }
     if (outcome === true) continue;
     attempt.terminalArm = attempt.appliedRepairs.includes(key) ? 'KC-5' : 'KC-6';

package/src/entry/kernel-terminal.mjs

@@ -49,14 +49,27 @@ export function terminal(kernel, attempt, status, message) {
   // THE COMPOSITION'S OWN FLOOR, TAKEN OFF THE MEMBER IT WAS DECIDED ON (`composition-and-states.md
   // §2.6` item 5 (b)): a still-owed op's call meeting either floor code makes the arm `KC-8` WHATEVER
   // the pass's own arm was, and nothing is restored (item 6 (a), (c)).
-  const finalStatus = floor === null ? status : KC.rollbackFloor;
-  const finalMessage = floor === null
-    ? message
-    : `the per-op rollback met the store's own ${floor.code} at ${floor.opId}`;
+  //
+  // **⟶ AND THE SAVE ARM'S OWN TOKEN IS NOT OVERWRITTEN BY IT — `D-53`'s THIRD RULING, 2026-10-28.** **THE FLOOR
+  // BELONGS TO THE COMPOSITION AND `KC-8` KEEPS ITS DECLARED MEANING; what it may not do is make a SAVE FAILURE
+  // and a CONSTRAINT REFUSAL end at the same token**, which is the contradiction `D-52` measured (*"`KC-8` crosses
+  // as both statuses"*). **SO THE PRECEDENCE IS ONE SENTENCE: THE FLOOR GOVERNS EVERY ARM BUT THE SAVE'S, and the
+  // save's arm keeps `KC-9`, its own message, and the floor's own sentence beside it** — so the caller can still
+  // read, from the ONE `outcome` entry, both what failed and what the composition then met.
+  const floorGoverns = floor !== null && status !== KC.saveFailed;
+  const finalStatus = floorGoverns ? KC.rollbackFloor : status;
+  const finalMessage = floorGoverns
+    ? `the per-op rollback met the store's own ${floor.code} at ${floor.opId}`
+    : floor === null
+      ? message
+      : `${message} — the per-op rollback then met the store's own ${floor.code} at ${floor.opId}`;
   // THE `outcome` ENTRY — appended ONCE, and `state` is THE ARM'S ONE TOKEN: the floor is answered IN THIS
   // SAME ENTRY where the attempt would also have had a failure arm, and NO SECOND ENTRY IS APPENDED
   // (`kernel-surface.md §2.5` item 1's kind table; `§2.6` item 6 (a), (b)).
-  append(attempt, 'outcome', null, attempt.ops[attempt.ops.length - 1].opId, finalMessage, finalStatus);
+  // **⟶ AND ITS ITERATION NAMES NO PAIR AND THE ATTEMPT'S LAST OP — `D-53`'s first ruling**, so the two columns
+  // travel as one identity wherever an op exists and read `null` where one does not ("an `outcome` names them
+  // where they exist").
+  append(attempt, 'outcome', { pair: null, op: attempt.ops[attempt.ops.length - 1] }, finalMessage, finalStatus);
   // THE DISCARD RULE, AT ITS ONE OBSERVABLE (`attempt-lifecycle.md §2.4` item 8 (i) (5), read with
   // `kernel-surface.md §2.1` item 2's discarded-set clause; `A: docs/decisions.md` · `A112`): where the
   // attempt's own write FAILED the registered constraints at its landing and could not be repaired, its